301

Re: DaVinci Junior cartridge reset

Bozotclown1970 wrote:

I understand that, but where is it generated. Does it already exist on a new chip or does it get created when a chip is used? How does the firmware know each password if it is already on the chip?

Can be as simple as running the ID of the chip though a predefined algorithm in the firmware.  We will never know...

302 (edited by Alien_Ant_Farm 2016-01-19 16:19:03)

Re: DaVinci Junior cartridge reset

hydronaut wrote:
Bozotclown1970 wrote:

I understand that, but where is it generated. Does it already exist on a new chip or does it get created when a chip is used? How does the firmware know each password if it is already on the chip?

Can be as simple as running the ID of the chip though a predefined algorithm in the firmware.  We will never know...

Page 30 on the data sheet for NTAG21x says "To improve the overall system security, it is advisable to diversify the password
and the password acknowledge using a die individual parameter of the IC, that is the
7-byte UID available on NTAG21x." Looking at the two green spools that we know the password and ID to we see the passwords are totally different but yet the IDs are only different in the 2nd byte. If there is any chance the ID creates the password then it has to be with that 2nd byte.

Green 1 200 of 200m
         Hex  Dec
ID:    4F     79             
Pass: 75     117
         9A     154
         67     103
         0D     13

Green 2 200 of 200m
         Hex  Dec
ID:    20     32             
Pass: 93     147
         1B     27
         18     24
         0C     12

I don't see a relationship but maybe someone will.
Here's the data sheet. Good read for anyone who wants to understand what we are up against.
http://cache.nxp.com/documents/data_she … df?pspll=1

303

Re: DaVinci Junior cartridge reset

I don't know that this helps a lot.  Maybe a little....

I just received my Logic 4 and started looking at the I2C communications between the PN512 and the motherboard.  I'm still waiting on my Arduino shield to read the specific contents of my card.  I've been looking through the data searching for the password information.  Once I found that, I started walking backward to see what information is sent to the motherboard from the card.  While I don't know that the motherboard uses all of the data, it appears to be requesting (and getting) the first 36 bytes of data from the card.  From what others have shown, this information includes the card ID along with the rest of the "public" information before a password is needed. 

I was hoping to find the motherboard was only grabbing a few bytes of card information to generate the password.  And, I guess it's still possible if it discards portions of the data.  Looks like it has access to everything to generate the password.

304

Re: DaVinci Junior cartridge reset

Is there any way to completely erase a card and replace it with the contents of another chip that someone posts so I do not have to buy any other hardware (I already have an NFC shield for my arduino)

305

Re: DaVinci Junior cartridge reset

jakecrowley,

Just what I am looking for. I have ordered a Arduino and the Shield in hopes someone would provide the steps need to backup and restore the chip. I have two new spools on order and am willing to provide the images if someone can explain how to back them up.

306

Re: DaVinci Junior cartridge reset

I also have two spools arriving Monday and would be happy to share the contents of the chip

307

Re: DaVinci Junior cartridge reset

Bozotclown - currently the only way to access all the data on your existing card is to open the printer and physically attach a logic sniffer to the board that reads the tag.  You literally need to steal the stream of data running in the machine and them locate where the board gets the password and take that password.  Once you have the password you can then access the data on the card using an Arduino shield using that password.  At this point someone has been able to get the password - read the data on the existing card - and write back the data that changed after a print back to the date that was there before the print. 

On the other hand what Jakecrowley is asking is very interesting I would like to look into.  Is it possible for someone who has cracked the password to provide the data to be copied to an existing Tag or a fresh tag?  Is the copying more involved then just knowing what is on each page and writing the data from the cracked tag to each page of the fresh or existing tag?  Is there some kind of way it has to compile to work?

308

Re: DaVinci Junior cartridge reset

greatone76 - Thank you for your precise information. So this will require me to purchase a sniffer also.

309

Re: DaVinci Junior cartridge reset

greatone76 has the procedure exactly correct.  There have been a few card "downloads" posted in this thread.  But, unfortunately, those don't include all the data on the card.  I think there a few more bytes of information that weren't included in those listings.  Toward the end of the memory on the card, I think there are specific values that are returned to the microcontroller after successfully sending the correct password.  I could be wrong, though....  Also, I'm not sure if the UID bytes at the start of the data can be overwritten.

As soon as my NFC shield arrives, I'm going to give this a try.  It was supposed to be here on Monday.  Still waiting...  I have the original spool with a few meters left on the card.  And, I have two new spools (one black, one natural) I was going to try reading and cloning.  I've already sniffed the password for the original spool just like was done earlier in this thread. 

If this works, I would imagine for those who didn't want to deal with purchasing a logic analyzer, a "pre-programmed" 100m card could be swapped along with the appropriate password.  Then, all you'd need is the password/data from the card in an Arduino to reset the length periodically. 

Also, I know there was talk about the potential of temperature differences in XYZ PLA vs. others being a problem.  I've been using Hatchbox PLA (advertised 180-210degC) without modifying the output/G-code of the XYZ application.  The prints look just as good as the original PLA included with the printer.  No jams or other problems.  I'm sure there are other PLAs that will work (and some that won't), too.  Just thought I'd pass this info along in case someone else is getting started and looking for a substitute PLA to use.  There is one drawback, though.  The XYZ spools are smaller in diameter (probably because there's less PLA).  I had to open up the side of the printer, disassemble the existing spool holder (and NFC-related stuff) and make a spool holder out of spare plastic plumbing pieces to get it to feed halfway decent.

310

Re: DaVinci Junior cartridge reset

jakecrowley wrote:

Is there any way to completely erase a card and replace it with the contents of another chip that someone posts so I do not have to buy any other hardware (I already have an NFC shield for my arduino)

I think there's a catch-22 with this.  In order to erase the card, you'd need that card's password first.  The hope is that once you have a valid password/card combination, it would be possible to rewrite the entire chip.  This has yet to be proven, though.

311

Re: DaVinci Junior cartridge reset

81TTA wrote:

I don't know that this helps a lot.  Maybe a little....

I just received my Logic 4 and started looking at the I2C communications between the PN512 and the motherboard.  I'm still waiting on my Arduino shield to read the specific contents of my card.  I've been looking through the data searching for the password information.  Once I found that, I started walking backward to see what information is sent to the motherboard from the card.  While I don't know that the motherboard uses all of the data, it appears to be requesting (and getting) the first 36 bytes of data from the card.  From what others have shown, this information includes the card ID along with the rest of the "public" information before a password is needed. 

I was hoping to find the motherboard was only grabbing a few bytes of card information to generate the password.  And, I guess it's still possible if it discards portions of the data.  Looks like it has access to everything to generate the password.


Can you post a description of the connections you made, and did you have to use any external pull up resistors with the logic 4?

Thanks!

312

Re: DaVinci Junior cartridge reset

I'm just thinking about throwing an Arduino Pro Mini in there emulating the pn512 and resetting the count everything the Junior powers on. $9.00 chip. how hard could it be?

313

Re: DaVinci Junior cartridge reset

crcasey wrote:

Can you post a description of the connections you made, and did you have to use any external pull up resistors with the logic 4?

Thanks!

This was listed earlier in the thread (post #87) by crgpgh.  I was simply following what was done there.  Just hooked the Logic 4 directly up to the connector.  I didn't have to add any pullup resistors.

314

Re: DaVinci Junior cartridge reset

I just received my logic analyzer today. I am a bit confused on how to use it. I tried to use the pictures on WB6CQA's page but it didn't help. What was the Arduino for? Anyway can anyone help out a newbie?

315

Re: DaVinci Junior cartridge reset

jakecrowley wrote:

I just received my logic analyzer today. I am a bit confused on how to use it. I tried to use the pictures on WB6CQA's page but it didn't help. What was the Arduino for? Anyway can anyone help out a newbie?


Not to sound rude, but why would you buy equipment you have no knowledge of use or function for? I realize you want to help but if you don't know haw to use the needed equipment I think you might want to consider certain projects over your head.. The only thing I can suggest is maybe do a Google search for guides..

Printing since 2009 and still love it!
Anycubic 4MAX best $225 ever invested.
Voxelabs Proxima SLA. 6 inch 2k Mono LCD.
Anycubic Predator, massive Delta machine. 450 x 370 print envelope.

316 (edited by jakecrowley 2016-01-22 01:18:36)

Re: DaVinci Junior cartridge reset

carl_m1968 wrote:
jakecrowley wrote:

I just received my logic analyzer today. I am a bit confused on how to use it. I tried to use the pictures on WB6CQA's page but it didn't help. What was the Arduino for? Anyway can anyone help out a newbie?


Not to sound rude, but why would you buy equipment you have no knowledge of use or function for? I realize you want to help but if you don't know haw to use the needed equipment I think you might want to consider certain projects over your head.. The only thing I can suggest is maybe do a Google search for guides..

I have a basic idea on how to use one and have already used it successfully on a test circuit. I was just confused because the wires connected to the NFC board were connected to an Arduino, then the logic analyzer was connected to the Arduino.

Picture:
http://3.bp.blogspot.com/-XxziN2YtT3w/V … 235148.jpg

317

Re: DaVinci Junior cartridge reset

jakecrowley wrote:

I just received my logic analyzer today. I am a bit confused on how to use it. I tried to use the pictures on WB6CQA's page but it didn't help. What was the Arduino for? Anyway can anyone help out a newbie?

The arduino is not needed for that part. I think he was trying to send the data using the arduino. The last two pins on the PN512 (looking from the front of the printer to the back) is SDA and SCL in that order. Set your analyzer to read I2C and connect your 2 pins accordingly to read SDA and SCL. Make sure the printer is not on. The set the analyzer to decode hex and record 10-15 seconds of the printer turning on. Then looking at your recorded data search for the hex byte 1B. You should see a single 1B on start up and then some two more bytes (50 and 0C I think) and the first byte of the password, then two more bytes and the 2nd byte of the password and so on. You should have your 4 bytes of your pass now! Whoop!

318

Re: DaVinci Junior cartridge reset

Alien_Ant_Farm wrote:
jakecrowley wrote:

I just received my logic analyzer today. I am a bit confused on how to use it. I tried to use the pictures on WB6CQA's page but it didn't help. What was the Arduino for? Anyway can anyone help out a newbie?

The arduino is not needed for that part. I think he was trying to send the data using the arduino. The last two pins on the PN512 (looking from the front of the printer to the back) is SDA and SCL in that order. Set your analyzer to read I2C and connect your 2 pins accordingly to read SDA and SCL. Make sure the printer is not on. The set the analyzer to decode hex and record 10-15 seconds of the printer turning on. Then looking at your recorded data search for the hex byte 1B. You should see a single 1B on start up and then some two more bytes (50 and 0C I think) and the first byte of the password, then two more bytes and the 2nd byte of the password and so on. You should have your 4 bytes of your pass now! Whoop!

It worked! Thank you so much for your help. I was able to successfully authenticate to the chip through my arduino shield. I tried editing the spool length values but it read Unidentified Spool after trying to check the data. After i restored the original values, it worked again. I originally thought the printer could be recording the spool values according to the chip serial number and checking to see if they are consistent, but I realized that in the original post he copied another chip and put its values onto the empty chip and it worked, so that couldn't be right. Do you have any ideas on this? Anyway, I have two spools arriving Monday so I should be able to play around with it.

319

Re: DaVinci Junior cartridge reset

Congratulations!!  Nothing like the feeling of figuring out how to use equipment you have no knowledge of use or function for... smile

Found out my reader is going to be delayed a little while longer.  I'm curious if you're able to read *all* the pages of the NFC via the Arduino.  The previous dumps showed the data ending before hitting the pages that contain some config, password and acknowledge pages. 

Wondering if those areas could be rewritten as well.  This goes to whether it's possible to "clone" a card or if we're stuck only re-writing identical information to the same card.  If we can't read/write the whole 00h->2Ch, we'll be stuck having to read an existing card, sniffing the password and just updating the few pages that change based on filament usage.  If everything can be read/written, it would be possible (I'd imagine?) for someone who doesn't want to buy the extra equipment to sniff the password to simply obtain a "blank" NFC card and program it with an Arduino with a known-good download.

320

Re: DaVinci Junior cartridge reset

I am assuming, possibly incorrectly, that the printer, not the chip records the data on spool usage. If that is so, could we not exchange used chips, refill our spools with whatever PLA we want, and print on? anybody what to swap a used RFID card with me?

321

Re: DaVinci Junior cartridge reset

Well, a successful snoop and dump has been completed on my original spool of "neutral" filament.

Here is the code and the dump for you all to skim through.

Password : B2 D6 12 23

Hello!
Found chip PN532
Firmware ver. 1.6
Waiting for an ISO14443A Card ...
Found an ISO14443A card
  UID Length: 7 bytes
  UID Value: 0x04 0x01 0x2D 0x22 0x97 0x3C 0x81

Seems to be an NTAG2xx tag (7 byte UID)
PAGE 00: 04 01 2D A0  ..- 
PAGE 01: 22 97 3C 81  "—<�
PAGE 02: 08 48 00 00  .H..
PAGE 03: E1 10 12 00  á...
PAGE 04: 01 03 A0 0C  .. .
PAGE 05: 34 03 00 FE  4..þ
PAGE 06: 00 00 00 00  ....
PAGE 07: 00 00 00 00  ....
PAGE 08: 5A 50 5A 00  ZPZ.
PAGE 09: 00 35 33 56  .53V
PAGE 10: A0 86 01 00   †..
PAGE 11: A0 86 01 00   †..
PAGE 12: D2 00 2D 00  Ò.-.
PAGE 13: 54 48 47 42  THGB
PAGE 14: 30 31 38 36  0186
PAGE 15: 00 00 00 00  ....
PAGE 16: 00 00 00 00  ....
PAGE 17: 34 00 00 00  4...
PAGE 18: 00 00 00 00  ....
PAGE 19: 00 00 00 00  ....
PAGE 20: 21 32 01 00  !2..
PAGE 21: 69 20 33 54  i 3T
PAGE 22: B3 5D E1 CE  ³]áÎ
PAGE 23: 35 8C 49 76  5ŒIv
PAGE 24: 00 00 00 00  ....
PAGE 25: 00 00 00 00  ....
PAGE 26: 00 00 00 00  ....
PAGE 27: 00 00 00 00  ....
PAGE 28: 00 00 00 00  ....
PAGE 29: 00 00 00 00  ....
PAGE 30: 00 00 00 00  ....
PAGE 31: 00 00 00 00  ....
PAGE 32: 00 00 00 00  ....
PAGE 33: 00 00 00 00  ....
PAGE 34: 00 00 00 00  ....
PAGE 35: 00 00 00 00  ....
PAGE 36: 00 00 00 00  ....
PAGE 37: 00 00 00 00  ....
PAGE 38: 00 00 00 00  ....
PAGE 39: 00 00 00 00  ....
PAGE 40: 00 00 00 BD  ...½
PAGE 41: 07 00 00 08  ....



Note:  In the ADAFruit example code the readout buffer is smaller than the loop counter, make sure you change that up.

-Cecil

322

Re: DaVinci Junior cartridge reset

Here is the same spool with .649M  more of the filament used.  This was 2.5 filled in passes (about 9 sliced layers) of the "sample" vase that is on the SD card.

Starting count on the previous spool dump 78369.
Count on this dump of the spool is 77720, for the difference of 649.

Hello!
Found chip PN532
Firmware ver. 1.6
Waiting for an ISO14443A Card ...
Found an ISO14443A card
  UID Length: 7 bytes
  UID Value: 0x04 0x01 0x2D 0x22 0x97 0x3C

0x81

Seems to be an NTAG2xx tag (7 byte UID)
PAGE 00: 04 01 2D A0  ..- 
PAGE 01: 22 97 3C 81  "—<
PAGE 02: 08 48 00 00  .H..
PAGE 03: E1 10 12 00  á...
PAGE 04: 01 03 A0 0C  .. .
PAGE 05: 34 03 00 FE  4..þ
PAGE 06: 00 00 00 00  ....
PAGE 07: 00 00 00 00  ....
PAGE 08: 5A 50 5A 00  ZPZ.
PAGE 09: 00 35 33 56  .53V
PAGE 10: A0 86 01 00   †..
PAGE 11: A0 86 01 00   †..
PAGE 12: D2 00 2D 00  Ò.-.
PAGE 13: 54 48 47 42  THGB
PAGE 14: 30 31 38 36  0186
PAGE 15: 00 00 00 00  ....
PAGE 16: 00 00 00 00  ....
PAGE 17: 34 00 00 00  4...
PAGE 18: 00 00 00 00  ....
PAGE 19: 00 00 00 00  ....
PAGE 20: 98 2F 01 00  ˜/..
PAGE 21: D0 3D 33 54  Ð=3T
PAGE 22: 08 53 E1 CE  .SáÎ
PAGE 23: AA 82 49 76  ª‚Iv
PAGE 24: 00 00 00 00  ....
PAGE 25: 00 00 00 00  ....
PAGE 26: 00 00 00 00  ....
PAGE 27: 00 00 00 00  ....
PAGE 28: 00 00 00 00  ....
PAGE 29: 00 00 00 00  ....
PAGE 30: 00 00 00 00  ....
PAGE 31: 00 00 00 00  ....
PAGE 32: 00 00 00 00  ....
PAGE 33: 00 00 00 00  ....
PAGE 34: 00 00 00 00  ....
PAGE 35: 00 00 00 00  ....
PAGE 36: 00 00 00 00  ....
PAGE 37: 00 00 00 00  ....
PAGE 38: 00 00 00 00  ....
PAGE 39: 00 00 00 00  ....
PAGE 40: 00 00 00 BD  ...½
PAGE 41: 07 00 00 08  ....


Maybe this will help someone figure out how that pages 21, 22, and 23 are hashing the length to checksum the spool.

-Cecil

323

Re: DaVinci Junior cartridge reset

Cecil, so is that data coming from the RFID card, or from the printer's internal memory?

324

Re: DaVinci Junior cartridge reset

jhorwitz wrote:

Cecil, so is that data coming from the RFID card, or from the printer's internal memory?

Directly from the RFID card that is in the spool.

-C

325

Re: DaVinci Junior cartridge reset

So up in posts 321 and 322 I goofed up.  I used the Adafruit example code, but I didn't update the loop count to 45.  So I only ended up dumping the first 42 data pages from the chip.  This would be fine for a 203 series IC but not so great for the 213 chip.  The count on this dump of the spool is 77720, same as it was in post 322.  I will use a bit more filament tomorrow and post another dump with the entire set of code pages.

Hello!
Found chip PN532
Firmware ver. 1.6
Waiting for an ISO14443A Card ...
Found an ISO14443A card
  UID Length: 7 bytes
  UID Value: 0x04 0x01 0x2D 0x22 0x97 0x3C 0x81

Seems to be an NTAG2xx tag (7 byte UID)
PAGE 00: 04 01 2D A0  ..- 
PAGE 01: 22 97 3C 81  "—<�
PAGE 02: 08 48 00 00  .H..
PAGE 03: E1 10 12 00  á...
PAGE 04: 01 03 A0 0C  .. .
PAGE 05: 34 03 00 FE  4..þ
PAGE 06: 00 00 00 00  ....
PAGE 07: 00 00 00 00  ....
PAGE 08: 5A 50 5A 00  ZPZ.
PAGE 09: 00 35 33 56  .53V
PAGE 10: A0 86 01 00   †..
PAGE 11: A0 86 01 00   †..
PAGE 12: D2 00 2D 00  Ò.-.
PAGE 13: 54 48 47 42  THGB
PAGE 14: 30 31 38 36  0186
PAGE 15: 00 00 00 00  ....
PAGE 16: 00 00 00 00  ....
PAGE 17: 34 00 00 00  4...
PAGE 18: 00 00 00 00  ....
PAGE 19: 00 00 00 00  ....
PAGE 20: 98 2F 01 00  ˜/..
PAGE 21: D0 3D 33 54  Ð=3T
PAGE 22: 08 53 E1 CE  .SáÎ
PAGE 23: AA 82 49 76  ª‚Iv
PAGE 24: 00 00 00 00  ....
PAGE 25: 00 00 00 00  ....
PAGE 26: 00 00 00 00  ....
PAGE 27: 00 00 00 00  ....
PAGE 28: 00 00 00 00  ....
PAGE 29: 00 00 00 00  ....
PAGE 30: 00 00 00 00  ....
PAGE 31: 00 00 00 00  ....
PAGE 32: 00 00 00 00  ....
PAGE 33: 00 00 00 00  ....
PAGE 34: 00 00 00 00  ....
PAGE 35: 00 00 00 00  ....
PAGE 36: 00 00 00 00  ....
PAGE 37: 00 00 00 00  ....
PAGE 38: 00 00 00 00  ....
PAGE 39: 00 00 00 00  ....
PAGE 40: 00 00 00 BD  ...½
PAGE 41: 07 00 00 08  ....
PAGE 42: 80 05 00 00  €...
PAGE 43: 00 00 00 00  ....
PAGE 44: 00 00 00 00  ....


-Cecil