Re: DaVinci Junior cartridge reset
@jakecrowley
Provide a tag readout so someone can match your data on thier tag and see if they get the spool error, so we can see if in fact they are recording tag info data locally.
You are not logged in. Please login or register.
SoliForum - 3D Printing Community → XYZ Printing Hacks & Mods → DaVinci Junior cartridge reset
@jakecrowley
Provide a tag readout so someone can match your data on thier tag and see if they get the spool error, so we can see if in fact they are recording tag info data locally.
@jakecrowley
Try to change line OE in 30333338 , for me i had the same error until i changed ALL the lines between 08 and 17 and now it's work fine, lot of thanks to greatone76
So those running the password attempt algorithm, can you try just one bit shifts within a byte... ie
HEX: 01 02 04 08 10 20 40 80
@wingnutmedia
See page 26. It been posted. My guess is it is crc to get the algorithm. It is nothing simple. The one bit change gives a huge differnce in password.
So I got some NTAG213 blanks and used LOGIC to capture the expected passwords for my blanks, then programmed the blank tags with appropriate data, set the password in page 43. I can then read back the data providing the appropriate password that was sniffed (no read if no password supplied), but the printer still shows 'unrecognized'. I think both the password and the PACK need to be known. Anyone have success writing BLANK NTAG213 ??? 

@wingnutmedia
See page 25. No one has succeed for the same reason you found. And you have to go back into the most likely the firmware to get the PACK check. Without recompiling and decoding the firmware someone would have to manually find the PACK algorithm.
@wingnutmedia
See page 25. No one has succeed for the same reason you found. And you have to go back into the most likely the firmware to get the PACK check. Without recompiling and decoding the firmware someone would have to manually find the PACK algorithm.
@greatone76
I have been on here since page 22, must have missed that in my original reading. Thanks for pointing it out.
I seem to need a lower feed rate. Than my color it setting.
Anyone found a feed rate in the tags?
@crcasey
If you go with a higher quality the overall print will be slower. Also, in settings under advanced there is a speed setting you can slow it there too. Not sure how much slower you need, but you can start there. I don't think there would be anything on the tag that would give speed/feed rate I would think that would come from the slicer.
Thank you for your continued work on this greatone76. I am excited to get my jr up and running.
Neil
Hi all,
I've bough my da vinci junior about a month ago and I've been trying to read every post on this forum. It seems that there is some great work done and I hope to contribute a bit.
I can program a bit and know a bit of electronics and arduino. I've got a PN532 board hooked up to my arduino and I'm trying to read out my NFC data. I know it is protected and I would like to bute force the password but it will all depend upon the security set on the nfc.
Upon inspecting the ntag213 data sheet, I've read that the can prevent brute force hacking by activating a counter in the nfc chip. (page 18 of the manual)
This counter is located at byte 0 on page 42 (ACCESS byte - see table 10)
This is where I need some help. Can the people who already have there password, read out their nfc tags and report the value of the access byte. If this is 00h, it means that brute force is possible to get the password out (may take a long time).
So who can check the setting of this byte?
Thanks from Belgium
manual: http://www.nxp.com/documents/data_sheet … 15_216.pdf
@maartenva.
bruteforcing the card password is well 1 in 4.228.250.625 or so
it is way faster to just get a cheap logic analyser from ebay or amazon.
but i guess it can be done if you have alot of time.
and as to page 42 byte 1 most of the datadumps here states that the try counter is set to 0
@maartenva.
bruteforcing the card password is well 1 in 4.228.250.625 or so
it is way faster to just get a cheap logic analyser from ebay or amazon.but i guess it can be done if you have alot of time.
and as to page 42 byte 1 most of the datadumps here states that the try counter is set to 0
Hi JustBen
that correct regarding the brute force. It will take far more time then reading out the i³C data and analysing it. But this is more easy and probably more for the masses. You don't need to open up your printer and you don't void warranty.
It the brute force works, maybe somebody can write an app for it and everybody can do it at home. If more people provide their data, we maybe can find a pattern or the algorithm they use.
The data dumps I found did all contain 80h for the ACCESS byte, withc means passwordprotection on, no count for brute force.
I also noticed that most of the dumps only show 42 of the 44 pages. They forgot to update the arduiono sketch to read 44 pages instead of the standard 42.
SO I guess I would give it a go and see what happens. Hopefully I don't ruin my tag.
well there is access on the bottom of the printer and a nicely marked nfc socket ready to be used.
but you are ofcourse welcome to bruteforce the passwd.
and the logic stuff has been documented by crcasey and what to search for.
but as you say bruteforcing is easyer for the masses in the end it's a time vs cost matter.
JustBen wrote:@maartenva.
bruteforcing the card password is well 1 in 4.228.250.625 or so
it is way faster to just get a cheap logic analyser from ebay or amazon.but i guess it can be done if you have alot of time.
and as to page 42 byte 1 most of the datadumps here states that the try counter is set to 0Hi JustBen
that correct regarding the brute force. It will take far more time then reading out the i³C data and analysing it. But this is more easy and probably more for the masses. You don't need to open up your printer and you don't void warranty.
It the brute force works, maybe somebody can write an app for it and everybody can do it at home. If more people provide their data, we maybe can find a pattern or the algorithm they use.The data dumps I found did all contain 80h for the ACCESS byte, withc means passwordprotection on, no count for brute force.
I also noticed that most of the dumps only show 42 of the 44 pages. They forgot to update the arduiono sketch to read 44 pages instead of the standard 42.SO I guess I would give it a go and see what happens. Hopefully I don't ruin my tag.
Ben,
If you are not seeing all 45 pages in your dumps. That can be corrected by making sure the Arduino code you are using is dumping all 45 pages. By making sure the following line is correct.
for (uint8_t i = 0; i < 45; i++) i dont really care about the dumps, the pages that are of interest to me has already been documented.
what i care about is reverse eng. the passwd/pack algo.
i dont really care about the dumps, the pages that are of interest to me has already been documented.
what i care about is reverse eng. the passwd/pack algo.
I have been looking for days on a way to get the Pack information. I did see where the old libraries did allow for that, but not the new ones.
well the pack is on the cards and seems to be "just as random as the passwd" the good point is that it's just 1 in 65k
as for where the value is stored is page 45/2Ch byte 0 and 1.
i cant remember if you can read out the values but i know that you can rewrite that value according to the ntag21x spec
Hi,
i bought the key and was able to reset the tag two times. However now it isn't working any more. I had changed every possible value to the ones from the sample tag in the manual and had also tried every possible combination with the colors/lenghts, but the printer always told me unknown spool when i try to open the spool statistics or try to print.
It couldn't be the printer, as i have a second tag (the one from the clear one, not hacked), which at least shows the statistics and with wich i was able to start a final print, as there had been 1 meter left.
I had attached the tag readout from the no longer working one. Could someone with a working tag please check this and tell me, if maybe there is a mistake in it?
Here is what I have on my partially used hacked stock card:
PAGE 00: 04 2F 40 E3
PAGE 01: 9A 29 49 81
PAGE 02: 7B 48 00 00
PAGE 03: E1 10 12 00
PAGE 04: 01 03 A0 0C
PAGE 05: 34 03 00 FE
PAGE 06: 00 00 00 00
PAGE 07: 00 00 00 00
PAGE 08: 5A 50 5A 00
PAGE 09: 00 35 33 54
PAGE 10: 40 0D 03 00
PAGE 11: 40 0D 03 00
PAGE 12: D2 00 2D 00
PAGE 13: 54 48 47 42
PAGE 14: 30 30 31 39
PAGE 15: 00 00 00 00
PAGE 16: 00 00 00 00
PAGE 17: 34 00 00 00
PAGE 18: 00 00 00 00
PAGE 19: 00 00 00 00
PAGE 20: 40 0D 03 00
PAGE 21: 08 1F 31 54
PAGE 22: 50 B1 E0 CE
PAGE 23: 52 E7 4F 76
PAGE 24: 00 00 00 00
PAGE 25: 00 00 00 00
PAGE 26: 00 00 00 00
PAGE 27: 00 00 00 00
PAGE 28: 00 00 00 00
PAGE 29: 00 00 00 00
PAGE 30: 00 00 00 00
PAGE 31: 00 00 00 00
PAGE 32: 00 00 00 00
PAGE 33: 00 00 00 00
PAGE 34: 00 00 00 00
PAGE 35: 00 00 00 00
PAGE 36: 00 00 00 00
PAGE 37: 00 00 00 00
PAGE 38: 00 00 00 00
PAGE 39: 00 00 00 00
PAGE 40: 00 00 00 BD
PAGE 41: 07 00 00 00
PAGE 42: 80 05 00 00
PAGE 43: 00 00 00 00
PAGE 44: 00 00 00 00
Use the card info posted here. Make sure to change Page 08 to actually match the instructable at 5A505000
Page 14: Should match the instructable as well at 30333338.
We have now seen this 2 or 3 times were after a few resets it gives spool error. The last time the issue was everything was good except page 14 was the old data. I'm kinda guessing that this number has something to do with the color and it needs to match perfectly with something I'm guessing in page 8. It also could be tracking the tag based on this number, but last time once this was changed the card worked again.
Try changing the 2 pages above and report back.
If that doesn't work we might want to try taking someone else dump and copying pages 8 to 14. It might be using one of those pages to track the card usage.
I'm also wondering if there is a simple if the same card is used in a certain number of times in row and counts up to a certain footage it errors out.
Anyone who has been through a few reset please update up with any of your observations.
IF you been through multiple resets have you used other card between uses ect.
Tried with these two changings, no sucess....
Just saw the new picture in the instructable, i had the old one.
I will check it again this evening.
Hi,
i bought the key and was able to reset the tag two times. However now it isn't working any more. I had changed every possible value to the ones from the sample tag in the manual and had also tried every possible combination with the colors/lenghts, but the printer always told me unknown spool when i try to open the spool statistics or try to print.
It couldn't be the printer, as i have a second tag (the one from the clear one, not hacked), which at least shows the statistics and with wich i was able to start a final print, as there had been 1 meter left.
I had attached the tag readout from the no longer working one. Could someone with a working tag please check this and tell me, if maybe there is a mistake in it?
IN your screenshot, you're missing a page 2C. this should contain the password ack bytes and some other things. Also page 2B should contain your password. Or is that never shown? I still need to break my password.
Did anybody tried to remove the lock bit from the tag but leave everything else in place? I'm wondering how the printer/tag would react on that. I don't know what the tag would do is the printer sends the password but it is not necessary to read/write the tag
@maartenva
yes ppl have removed the lock byte and the printer wont accept the card.
yes ppl have cloned the data to a new card and that don't work because they don't have the pack value ( I assume not tested this my self. ).
yes most obvious things have been tryed and documented here. ![]()
sry if this seems rude but as you said in your first post you have read this thread and all the info is in here.
SoliForum - 3D Printing Community → XYZ Printing Hacks & Mods → DaVinci Junior cartridge reset
Powered by PunBB, supported by Informer Technologies, Inc.