226

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

woogerboy21 wrote:
Teddyz wrote:
woogerboy21 wrote:

If my Jr's were not running almost constantly I would probably take the time to run down the IC's on the boards and track down which could potentially store the spool data.  Has anyone ever attempted to track down which potential IC's in the printer may house this data?

I have no JR, but I guess it should be possible. I made changes to my mini so I can use the same serial number over and over again. If you succeed, keep it as a secret so they don't increase the protection on next FW or model.

I was thinking more towards the idea of taking and reading the content of the IC and then after how ever long rewriting that same content back to the IC effectively "resetting" the memory state.  It's been a little while since I've had to read/write IC's but in theory even if they have some type of protection to prevent the IC chip's content from being tampered with you can still do a raw dump of the IC's content and write the raw dump back to the chip and never really tinker with the secured data.  It's not that I would be trying to tinker with it anyway.  I just want the IC to develop long term memory loss smile

If the list of used cards is in a separate memory IC and is not spread out to several places your idea will work. My only objection is the same as Bozotclown1970's, why bother until you have no serial numbers left to use? One spool (300m) every three days will let you print for more than three years. Will the printer survive that long? smile

227

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

If the list of used cards is in a separate memory IC and is not spread out to several places your idea will work. My only objection is the same as Bozotclown1970's, why bother until you have no serial numbers left to use? One spool (300m) every three days will let you print for more than three years. Will the printer survive that long?

Hense why my printers are printing and not ripped apart on the table smile

228

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

I have a Da Vinci Jr. with Firmware 1.0.4, is there anything I can do to help?

229

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

I have a Da Vinci Mini, and looking for some kind of resetter so i can use 3rd party PLA Fillmament. Thank you all in advance for any leads.

230

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

GFX wrote:

I have a Da Vinci Mini, and looking for some kind of resetter so i can use 3rd party PLA Fillmament. Thank you all in advance for any leads.

Maybe start with reading, rather than just asking...

231

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

woogerboy21 wrote:
Teddyz wrote:
woogerboy21 wrote:

If my Jr's were not running almost constantly I would probably take the time to run down the IC's on the boards and track down which could potentially store the spool data.  Has anyone ever attempted to track down which potential IC's in the printer may house this data?

I have no JR, but I guess it should be possible. I made changes to my mini so I can use the same serial number over and over again. If you succeed, keep it as a secret so they don't increase the protection on next FW or model.

I was thinking more towards the idea of taking and reading the content of the IC and then after how ever long rewriting that same content back to the IC effectively "resetting" the memory state.  It's been a little while since I've had to read/write IC's but in theory even if they have some type of protection to prevent the IC chip's content from being tampered with you can still do a raw dump of the IC's content and write the raw dump back to the chip and never really tinker with the secured data.  It's not that I would be trying to tinker with it anyway.  I just want the IC to develop long term memory loss smile

I have been using this method with my Da Vinci Mini W ever since I bought it almost a year ago and got mad about the NFC-thing (I didn´t know about it when I bought the printer.)

I doesn´t look that pretty, but it works smile

The chip is a Macronix MX25L3206EM2I-12G 32Mbit Flash Memory.



I have one NFC card that I reset with an Arduino and a NFC shield and I reprogram the printers eeprom with either a Raspberry PI or a computer using a FTDI-cable and Linux (Using the software flashrom either way.)

This works great and I've run probably 20kg´s of cheap PLA filament on the printer by now.

I mounted a socket on the back of the printer so that I can remove and reset the eeprom easily when needed. (I actually have a number of eeproms that I just swap out so I don´t have to flash them every time, I do them 10 at the time.)

Post's attachments

IMG_1570 - kopia.JPG
IMG_1570 - kopia.JPG 1.85 mb, 3 downloads since 2017-08-21 

IMG_1574 - kopia.JPG
IMG_1574 - kopia.JPG 1.71 mb, file has never been downloaded. 

You don't have the permssions to download the attachments of this post.

232

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456 wrote:
woogerboy21 wrote:
Teddyz wrote:

I have no JR, but I guess it should be possible. I made changes to my mini so I can use the same serial number over and over again. If you succeed, keep it as a secret so they don't increase the protection on next FW or model.

I was thinking more towards the idea of taking and reading the content of the IC and then after how ever long rewriting that same content back to the IC effectively "resetting" the memory state.  It's been a little while since I've had to read/write IC's but in theory even if they have some type of protection to prevent the IC chip's content from being tampered with you can still do a raw dump of the IC's content and write the raw dump back to the chip and never really tinker with the secured data.  It's not that I would be trying to tinker with it anyway.  I just want the IC to develop long term memory loss smile

I have been using this method with my Da Vinci Mini W ever since I bought it almost a year ago and got mad about the NFC-thing (I didn´t know about it when I bought the printer.)

I doesn´t look that pretty, but it works smile

The chip is a Macronix MX25L3206EM2I-12G 32Mbit Flash Memory.



I have one NFC card that I reset with an Arduino and a NFC shield and I reprogram the printers eeprom with either a Raspberry PI or a computer using a FTDI-cable and Linux (Using the software flashrom either way.)

This works great and I've run probably 20kg´s of cheap PLA filament on the printer by now.

I mounted a socket on the back of the printer so that I can remove and reset the eeprom easily when needed. (I actually have a number of eeproms that I just swap out so I don´t have to flash them every time, I do them 10 at the time.)


So, would you mind sharing just how you do this and the software you are using?

233 (edited by Daniel456 2017-08-22 11:39:31)

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Bozotclown1970 wrote:
Daniel456 wrote:
woogerboy21 wrote:

I was thinking more towards the idea of taking and reading the content of the IC and then after how ever long rewriting that same content back to the IC effectively "resetting" the memory state.  It's been a little while since I've had to read/write IC's but in theory even if they have some type of protection to prevent the IC chip's content from being tampered with you can still do a raw dump of the IC's content and write the raw dump back to the chip and never really tinker with the secured data.  It's not that I would be trying to tinker with it anyway.  I just want the IC to develop long term memory loss smile

I have been using this method with my Da Vinci Mini W ever since I bought it almost a year ago and got mad about the NFC-thing (I didn´t know about it when I bought the printer.)

I doesn´t look that pretty, but it works smile

The chip is a Macronix MX25L3206EM2I-12G 32Mbit Flash Memory.



I have one NFC card that I reset with an Arduino and a NFC shield and I reprogram the printers eeprom with either a Raspberry PI or a computer using a FTDI-cable and Linux (Using the software flashrom either way.)

This works great and I've run probably 20kg´s of cheap PLA filament on the printer by now.

I mounted a socket on the back of the printer so that I can remove and reset the eeprom easily when needed. (I actually have a number of eeproms that I just swap out so I don´t have to flash them every time, I do them 10 at the time.)


So, would you mind sharing just how you do this and the software you are using?

Sure, I just figured that this was something that "everyone" did already since it was so easy to find so I haven´t given it much thought to share it until now.

All I did was desolder the eeprom (SOIC-8 socket) and mounted it on an adapter/break-out board with a regular 0.1” pitch headers so I can swap them out fast and easy when needed.

I also bought 10 extra eeproms and mounted on the same adapter/break-out board so I can just swap out eeproms when needed, the chip is a MX25L3206EM2I-12G and they cost about €0.5 or $0.6 USD.

I read the eeprom with flashrom ( www.flashrom.org )
I use either a FTDI-cable as a programmer or a raspberry pi depending on what computer I have closest when I need to reset the eeproms

https://www.flashrom.org/FT2232SPI_Programmer
https://www.flashrom.org/RaspberryPi

The string to read the eeprom with flashrom with the FTDI cable is:
flashrom -p ft2232_spi:type=232H -c MX25L3206E -r file.rom

And to write to the eeprom you use:
flashrom -p ft2232_spi:type=232H -c MX25L3206E -w file.rom


I don´t remember the command for using a raspberry pi and I don´t have time to find the SD-card I have flashrom and my script on right now, but it´s all in the documentation for flashrom.

I don´t think I need to explain how to edit the meter-count in the RFID-tag since it´s commonly known.

So basically all I do is reset the eeprom every time I reset the RFID-tag, it´s as simple as that smile

http://soliforum.com/i/?vwjBmCb.jpg
http://soliforum.com/i/?yc46jxQ.jpg
http://soliforum.com/i/?ppno4i5.jpg
http://soliforum.com/i/?Pf5B0hK.jpg

234 (edited by cgrillo 2017-08-22 12:03:47)

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456 wrote:
Bozotclown1970 wrote:
Daniel456 wrote:

I have been using this method with my Da Vinci Mini W ever since I bought it almost a year ago and got mad about the NFC-thing (I didn´t know about it when I bought the printer.)

I doesn´t look that pretty, but it works smile

The chip is a Macronix MX25L3206EM2I-12G 32Mbit Flash Memory.



I have one NFC card that I reset with an Arduino and a NFC shield and I reprogram the printers eeprom with either a Raspberry PI or a computer using a FTDI-cable and Linux (Using the software flashrom either way.)

This works great and I've run probably 20kg´s of cheap PLA filament on the printer by now.

I mounted a socket on the back of the printer so that I can remove and reset the eeprom easily when needed. (I actually have a number of eeproms that I just swap out so I don´t have to flash them every time, I do them 10 at the time.)


So, would you mind sharing just how you do this and the software you are using?

Sure, I just figured that this was something that "everyone" did already since it was so easy to find so I haven´t given it much thought to share it until now.

All I did was desolder the eeprom (SOIC-8 socket) and mounted it on an adapter/break-out board with a regular 0.1” pitch headers so I can swap them out fast and easy when needed.

I also bought 10 extra eeproms and mounted on the same adapter/break-out board so I can just swap out eeproms when needed, the chip is a MX25L3206EM2I-12G and they cost about €0.5 or $0.6 USD.

I read the eeprom with flashrom ( www.flashrom.org )
I use either a FTDI-cable as a programmer or a raspberry pi depending on what computer I have closest when I need to reset the eeproms

https://www.flashrom.org/FT2232SPI_Programmer
https://www.flashrom.org/RaspberryPi

The string to read the eeprom with flashrom with the FTDI cable is:
flashrom -p ft2232_spi:type=232H -c MX25L3206E -r file.rom

And to write to the eeprom you use:
flashrom -p ft2232_spi:type=232H -c MX25L3206E -w file.rom


I don´t remember the command for using a raspberry pi and I don´t have time to find the SD-card I have flashrom and my script on right now, but it´s all in the documentation for flashrom.

I don´t think I need to explain how to edit the meter-count in the RFID-tag since it´s commonly known.

So basically all I do is reset the eeprom every time I reset the RFID-tag, it´s as simple as that smile

You have done a really good job there - thanks for the info.
It certainly shows that XYZ store the tag info in EEPROM.
Have you managed to decode what else is in the ROM - or how the data is stored in there?
It certainly shows us that there is another way around the storing of tag info in the printer.

235

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

You have done a really good job there - thanks for the info.
It certainly shows that XYZ store the tag info in EEPROM.
Have you managed to decode what else is in the ROM - or how the data is stored in there?
It certainly shows us that there is another way around the storing of tag info in the printer.

No, I didn´t see any use in trying to identify exactly what the eeprom contained, all I wanted to do was use any filament I wanted so I didn´t want to spend too much time on it, this little hack only took me about 4 hours and that was including attaching a Picoscope to the RFID-reader in the printer so I could get the keys for my RFID-tags out.

I probably spent another hour in getting the Arduino-code to work automatically, now all I do is power up the Arduino and place my RFID-tag on the PN532 and wait a couple of seconds for it to reset the tag.

I plan on putting some switches on the PN532-Shield so I can choose color of the tag (to adjust the temperature to better match different brands of filament.), but for now I just adjust the Ardunio-code when I switch color/temperature.

I am thinking of spoofing the temperature-sensor from the extruder so I can adjust the temperature more precise, but I haven´t had time to start with this project yet.

I have read out the eeprom in the extruder too just for fun but I don´t know if I´ll get any use of that since the printer don´t seem to care about the number of hours of the extruder.

236

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456 wrote:
Bozotclown1970 wrote:
Daniel456 wrote:

I have been using this method with my Da Vinci Mini W ever since I bought it almost a year ago and got mad about the NFC-thing (I didn´t know about it when I bought the printer.)

I doesn´t look that pretty, but it works smile

The chip is a Macronix MX25L3206EM2I-12G 32Mbit Flash Memory.



I have one NFC card that I reset with an Arduino and a NFC shield and I reprogram the printers eeprom with either a Raspberry PI or a computer using a FTDI-cable and Linux (Using the software flashrom either way.)

This works great and I've run probably 20kg´s of cheap PLA filament on the printer by now.

I mounted a socket on the back of the printer so that I can remove and reset the eeprom easily when needed. (I actually have a number of eeproms that I just swap out so I don´t have to flash them every time, I do them 10 at the time.)


So, would you mind sharing just how you do this and the software you are using?

Sure, I just figured that this was something that "everyone" did already since it was so easy to find so I haven´t given it much thought to share it until now.

All I did was desolder the eeprom (SOIC-8 socket) and mounted it on an adapter/break-out board with a regular 0.1” pitch headers so I can swap them out fast and easy when needed.

I also bought 10 extra eeproms and mounted on the same adapter/break-out board so I can just swap out eeproms when needed, the chip is a MX25L3206EM2I-12G and they cost about €0.5 or $0.6 USD.

I read the eeprom with flashrom ( www.flashrom.org )
I use either a FTDI-cable as a programmer or a raspberry pi depending on what computer I have closest when I need to reset the eeproms

The string to read the eeprom with flashrom with the FTDI cable is:
flashrom -p ft2232_spi:type=232H -c MX25L3206E -r file.rom

And to write to the eeprom you use:
flashrom -p ft2232_spi:type=232H -c MX25L3206E -w file.rom


I don´t remember the command for using a raspberry pi and I don´t have time to find the SD-card I have flashrom and my script on right now, but it´s all in the documentation for flashrom.

I don´t think I need to explain how to edit the meter-count in the RFID-tag since it´s commonly known.

So basically all I do is reset the eeprom every time I reset the RFID-tag, it´s as simple as that smile

Thank you very much for that information. Can't say I really understand all of it but it is a really great idea and project you put together. Thank you for sharing.

237

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456 wrote:

You have done a really good job there - thanks for the info.
It certainly shows that XYZ store the tag info in EEPROM.
Have you managed to decode what else is in the ROM - or how the data is stored in there?
It certainly shows us that there is another way around the storing of tag info in the printer.

No, I didn´t see any use in trying to identify exactly what the eeprom contained, all I wanted to do was use any filament I wanted so I didn´t want to spend too much time on it, this little hack only took me about 4 hours and that was including attaching a Picoscope to the RFID-reader in the printer so I could get the keys for my RFID-tags out.

I probably spent another hour in getting the Arduino-code to work automatically, now all I do is power up the Arduino and place my RFID-tag on the PN532 and wait a couple of seconds for it to reset the tag.

I plan on putting some switches on the PN532-Shield so I can choose color of the tag (to adjust the temperature to better match different brands of filament.), but for now I just adjust the Ardunio-code when I switch color/temperature.

I am thinking of spoofing the temperature-sensor from the extruder so I can adjust the temperature more precise, but I haven´t had time to start with this project yet.

I have read out the eeprom in the extruder too just for fun but I don´t know if I´ll get any use of that since the printer don´t seem to care about the number of hours of the extruder.


This is certainly an alternative to our EMUTAG solution  - for those who are happy to open up the bottom cover of the printer and get soldering.
I'll probably be making this adjustment to mine now smile

238

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Excellent job Daniel4456.  What you thought 'everyone' did was new to the whole community.   

cgrillo wrote:

This is certainly an alternative to our EMUTAG solution  - for those who are happy to open up the bottom cover of the printer and get soldering.
I'll probably be making this adjustment to mine now smile

cgrillo, be interesting to follow your change, please post your exploits as you do this.

239

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Excellent job Daniel456.  What you thought 'everyone' did was new to the whole community.   

cgrillo wrote:

This is certainly an alternative to our EMUTAG solution  - for those who are happy to open up the bottom cover of the printer and get soldering.
I'll probably be making this adjustment to mine now smile

cgrillo, be interesting to follow your change, please post your exploits as you do this.

240 (edited by cgrillo 2017-08-22 15:19:45)

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

mjf55 wrote:

Excellent job Daniel456.  What you thought 'everyone' did was new to the whole community.   

cgrillo wrote:

This is certainly an alternative to our EMUTAG solution  - for those who are happy to open up the bottom cover of the printer and get soldering.
I'll probably be making this adjustment to mine now smile

cgrillo, be interesting to follow your change, please post your exploits as you do this.

I've just realised that this would be a pointless change for me to do as my printer is still on f/w 2.2.0
I don't even need an EMUTAG for printing smile

I may however use all those $5 paypal payments made for passwords and buy another printer and deliberately update the firmware to see what changes are required..

241

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

So, I went out and got another Da Vinci Mini W today and modified it the same way as the first one just to try some stuff.

It seems that I can switch the eeprom between the machines without any problems.
I can use the eeprom-data from the old printer in the new one, and the brand new eeprom-data in the old one.

The printers has different firmwares too so that does not seem to matter either (1.1.4 on the old one and 1.0.6 on the new one.)

http://soliforum.com/i/?iNWCeZ3.jpg

242

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

I updated the old printer to the latest firmware (1.1.9) and my little hack still works, I had no problem to reset the RFID-tag and the eeprom to 200m.

243

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456, any chance of posting a complete hi-res ( highest you can) picture of your mini main board?  I would like to see how it compares to the Jr.
OR
whats the FCC Id of the mini.  I can go there to get the pictures.

244 (edited by Daniel456 2017-08-23 07:21:53)

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

mjf55 wrote:

Daniel456, any chance of posting a complete hi-res ( highest you can) picture of your mini main board?  I would like to see how it compares to the Jr.
OR
whats the FCC Id of the mini.  I can go there to get the pictures.

Sure, is this good enough?
I attached the picture to this post as well if that helps to get a higher resolution picture.


http://soliforum.com/i/?WBdrdMi.jpg

Post's attachments

IMG_4528 - kopia.JPG 2.5 mb, 3 downloads since 2017-08-23 

You don't have the permssions to download the attachments of this post.

245

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456, Thank you for that.  Can you tell me the marking on the large BGA chip by the USB port (that is not on the Jr ) and also the chip by the NFC connector?  On the Jr, that one is LPC1115F ( a cortex M0 processor ).  Just wondering.  Thanks

246

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

mjf55 wrote:

Daniel456, Thank you for that.  Can you tell me the marking on the large BGA chip by the USB port (that is not on the Jr ) and also the chip by the NFC connector?  On the Jr, that one is LPC1115F ( a cortex M0 processor ).  Just wondering.  Thanks

Sure, I´ll check that as soon as the prints I´m running are done, one is at 12 hours and one has approx 6 hours left, unless I forget to turn the printer up-side-down before I start the next print smile

247

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

I finally got some time over to open up the printer again and take a couple of pictures with my microscope.

It turns out the chip by the NFC is the same one as on the Jr.

The BGA is a Kingston EMMC04G-M627, a 4GB eMMC, so it´s the memory used to store the .3w file.


http://soliforum.com/i/?2Qq4U6q.jpg
http://soliforum.com/i/?zeJnbDY.jpg

248

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Thanks Daniel456.  Its good info.  Thank you.   Its amazing that you were able to do this.
So, this begs the question, What other mods do you have that you think 'everyone' has?  big_smile

249

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

mjf55 wrote:

Thanks Daniel456.  Its good info.  Thank you.   Its amazing that you were able to do this.
So, this begs the question, What other mods do you have that you think 'everyone' has?  big_smile

Well... it´s not amazing really, since resetting the RDIF-tags alone didn´t work it´s obvious that the printer is saving info about the tags somewhere, and since the eeprom does not have any encryption protection all it takes is a bit of soldering experience and a raspberry with I2C capability to test if the eeprom has the data about the tags.

I do have professional soldering/desoldering equipment and other equipment since a big part of my job consists of reverse-engineering, hacking, spoofing and modifiying different devices, besides designing and manufacture my own eqipment from scratch, so I do have about 25 years of experience in doing things like this, so this was a very fast and easy hack.

Now lets just hope xyz-printing doesn´t stop this little hack, it would be quite easy to stop if they wanted too.

250

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456 wrote:
mjf55 wrote:

Thanks Daniel456.  Its good info.  Thank you.   Its amazing that you were able to do this.
So, this begs the question, What other mods do you have that you think 'everyone' has?  big_smile

Well... it´s not amazing really, since resetting the RDIF-tags alone didn´t work it´s obvious that the printer is saving info about the tags somewhere, and since the eeprom does not have any encryption protection all it takes is a bit of soldering experience and a raspberry with I2C capability to test if the eeprom has the data about the tags.

I do have professional soldering/desoldering equipment and other equipment since a big part of my job consists of reverse-engineering, hacking, spoofing and modifiying different devices, besides designing and manufacture my own eqipment from scratch, so I do have about 25 years of experience in doing things like this, so this was a very fast and easy hack.

Now lets just hope xyz-printing doesn´t stop this little hack, it would be quite easy to stop if they wanted too.


By chance would you be able to easily tell how many tag ID's are stored in there?