751

Re: DaVinci Junior cartridge reset

@jakecrowley

Provide a tag readout so someone can match your data on thier tag and see if they get the spool error, so we can see if in fact they are recording tag info data locally.

752

Re: DaVinci Junior cartridge reset

@jakecrowley

Try to change line OE in 30333338 , for me i had the same error until i changed ALL the lines between 08 and 17 and now it's work fine, lot of thanks to greatone76

753

Re: DaVinci Junior cartridge reset

So those running the password attempt algorithm, can you try just one bit shifts within a byte... ie
HEX: 01 02 04 08 10 20 40 80

754

Re: DaVinci Junior cartridge reset

@wingnutmedia

See page 26. It been posted. My guess is it is crc to get the algorithm. It is nothing simple. The one bit change gives a huge differnce in password.

755 (edited by wingnutmedia 2016-03-27 21:26:59)

Re: DaVinci Junior cartridge reset

So I got some NTAG213 blanks and used LOGIC to capture the expected passwords for my blanks, then programmed the blank tags with appropriate data, set the password in page 43.  I can then read back the data providing the appropriate password that was sniffed (no read if no password supplied), but the printer still shows 'unrecognized'.  I think both the password and the PACK need to be known.   Anyone have success writing BLANK NTAG213 ???   http://soliforum.com/i/?v9PpAgs.pnghttp://soliforum.com/i/?OCjrlH4.png

756

Re: DaVinci Junior cartridge reset

@wingnutmedia
See page 25. No one has succeed for the same reason you found.  And you have to go back into the most likely the firmware to get the PACK check.  Without recompiling and decoding the firmware someone would have to manually find the PACK algorithm.

757

Re: DaVinci Junior cartridge reset

greatone76 wrote:

@wingnutmedia
See page 25. No one has succeed for the same reason you found.  And you have to go back into the most likely the firmware to get the PACK check.  Without recompiling and decoding the firmware someone would have to manually find the PACK algorithm.

@greatone76

I have been on here since page 22, must have missed that in my original reading.  Thanks for pointing it out.

758

Re: DaVinci Junior cartridge reset

I seem to need a lower feed rate.  Than my color it setting.

Anyone found a feed rate in the tags?

759

Re: DaVinci Junior cartridge reset

@crcasey

If you go with a higher quality the overall print will be slower.  Also, in settings under advanced there is a speed setting you can slow it there too.  Not sure how much slower you need, but you can start there.  I don't think there would be anything on the tag that would give speed/feed rate I would think that would come from the slicer.

760

Re: DaVinci Junior cartridge reset

Thank you for your continued work on this greatone76. I am excited to get my jr up and running.
Neil

761

Re: DaVinci Junior cartridge reset

Hi all,

I've bough my da vinci junior about a month ago and I've been trying to read every post on this forum. It seems that there is some great work done and I hope to contribute a bit.
I can program a bit and know a bit of electronics and arduino. I've got a PN532 board hooked up to my arduino and I'm trying to read out my NFC data. I know it is protected and I would like to bute force the password but it will all depend upon the security set on the nfc.
Upon inspecting the ntag213 data sheet, I've read that the can prevent brute force hacking by activating a counter in the nfc chip. (page 18 of the manual)
This counter is located at byte 0 on page 42 (ACCESS byte - see table 10)

This is where I need some help. Can the people who already have there password, read out their nfc tags and report the value of the access byte. If this is 00h, it means that brute force is possible to get the password out (may take a long time).

So who can check the setting of this byte?

Thanks from Belgium

manual: http://www.nxp.com/documents/data_sheet … 15_216.pdf

762

Re: DaVinci Junior cartridge reset

@maartenva.

bruteforcing the card password is well  1 in 4.228.250.625 or so
it is way faster to just get a cheap logic analyser from ebay or amazon.

but i guess it can be done if you have alot of time.
and as to page 42 byte 1 most of the datadumps here states that the try counter is set to 0

763

Re: DaVinci Junior cartridge reset

JustBen wrote:

@maartenva.

bruteforcing the card password is well  1 in 4.228.250.625 or so
it is way faster to just get a cheap logic analyser from ebay or amazon.

but i guess it can be done if you have alot of time.
and as to page 42 byte 1 most of the datadumps here states that the try counter is set to 0

Hi JustBen

that correct regarding the brute force. It will take far more time then reading out the i³C data and analysing it. But this is more easy and probably more for the masses. You don't need to open up your printer and you don't void warranty.
It the brute force works, maybe somebody can write an app for it and everybody can do it at home. If more people provide their data, we maybe can find a pattern or the algorithm they use.

The data dumps I found did all contain 80h for the ACCESS byte, withc means passwordprotection on, no count for brute force.
I also noticed that most of the dumps only show 42 of the 44 pages. They forgot to update the arduiono sketch to read 44 pages instead of the standard 42.


SO I guess I would give it a go and see what happens. Hopefully I don't ruin my tag.

764

Re: DaVinci Junior cartridge reset

well there is access on the bottom of the printer and a nicely marked nfc socket ready to be used.

but you are ofcourse welcome to bruteforce the passwd.
and the logic stuff has been documented by crcasey and what to search for.

but as you say bruteforcing is easyer for the masses in the end it's a time vs cost matter.

765

Re: DaVinci Junior cartridge reset

maartenva wrote:
JustBen wrote:

@maartenva.

bruteforcing the card password is well  1 in 4.228.250.625 or so
it is way faster to just get a cheap logic analyser from ebay or amazon.

but i guess it can be done if you have alot of time.
and as to page 42 byte 1 most of the datadumps here states that the try counter is set to 0

Hi JustBen

that correct regarding the brute force. It will take far more time then reading out the i³C data and analysing it. But this is more easy and probably more for the masses. You don't need to open up your printer and you don't void warranty.
It the brute force works, maybe somebody can write an app for it and everybody can do it at home. If more people provide their data, we maybe can find a pattern or the algorithm they use.

The data dumps I found did all contain 80h for the ACCESS byte, withc means passwordprotection on, no count for brute force.
I also noticed that most of the dumps only show 42 of the 44 pages. They forgot to update the arduiono sketch to read 44 pages instead of the standard 42.


SO I guess I would give it a go and see what happens. Hopefully I don't ruin my tag.

Ben,

If you are not seeing all 45 pages in your dumps. That can be corrected by making sure the Arduino code you are using is dumping all 45 pages. By making sure the following line is correct.

for (uint8_t i = 0; i < 45; i++) 

766

Re: DaVinci Junior cartridge reset

i dont really care about the dumps, the pages that are of interest to me has already been documented.

what i care about is reverse eng. the passwd/pack algo.

767

Re: DaVinci Junior cartridge reset

JustBen wrote:

i dont really care about the dumps, the pages that are of interest to me has already been documented.

what i care about is reverse eng. the passwd/pack algo.

I have been looking for days on a way to get the Pack information. I did see where the old libraries did allow for that, but not the new ones.

768

Re: DaVinci Junior cartridge reset

well the pack is on the cards and seems to be "just as random as the passwd" the good point is that it's just 1 in 65k

as for where the value is stored is page 45/2Ch byte 0 and 1.
i cant remember if you can read out the values but i know that you can rewrite that value according to the ntag21x spec

769 (edited by jenne 2016-03-31 23:26:17)

Re: DaVinci Junior cartridge reset

Hi, 

i bought the key and was able to reset the tag two times. However now it isn't working any more. I had changed every possible value to the ones from the sample tag in the manual and had also tried every possible combination with the colors/lenghts,  but the printer always told me unknown spool when i try to open the spool statistics or try to print. 

It couldn't be the printer,  as i have a second tag (the one from the clear one,  not hacked),  which at least shows the statistics and with wich i was able to start a final print,  as there had been 1 meter left.

I had attached the tag readout from the no longer working one. Could someone with a working tag please check this and tell me,  if maybe there is a mistake in it?

Post's attachments

Screenshot_2016-04-01-00-39-34.png
Screenshot_2016-04-01-00-39-34.png 323.55 kb, 2 downloads since 2016-03-31 

Screenshot_2016-04-01-00-40-18.png
Screenshot_2016-04-01-00-40-18.png 309.11 kb, 1 downloads since 2016-03-31 

You don't have the permssions to download the attachments of this post.

770

Re: DaVinci Junior cartridge reset

Here is what I have on my partially used hacked stock card:

PAGE 00: 04 2F 40 E3
PAGE 01: 9A 29 49 81 
PAGE 02: 7B 48 00 00
PAGE 03: E1 10 12 00
PAGE 04: 01 03 A0 0C
PAGE 05: 34 03 00 FE
PAGE 06: 00 00 00 00
PAGE 07: 00 00 00 00
PAGE 08: 5A 50 5A 00
PAGE 09: 00 35 33 54
PAGE 10: 40 0D 03 00
PAGE 11: 40 0D 03 00
PAGE 12: D2 00 2D 00
PAGE 13: 54 48 47 42
PAGE 14: 30 30 31 39
PAGE 15: 00 00 00 00
PAGE 16: 00 00 00 00
PAGE 17: 34 00 00 00
PAGE 18: 00 00 00 00
PAGE 19: 00 00 00 00
PAGE 20: 40 0D 03 00
PAGE 21: 08 1F 31 54
PAGE 22: 50 B1 E0 CE
PAGE 23: 52 E7 4F 76
PAGE 24: 00 00 00 00
PAGE 25: 00 00 00 00
PAGE 26: 00 00 00 00
PAGE 27: 00 00 00 00
PAGE 28: 00 00 00 00
PAGE 29: 00 00 00 00
PAGE 30: 00 00 00 00
PAGE 31: 00 00 00 00
PAGE 32: 00 00 00 00
PAGE 33: 00 00 00 00
PAGE 34: 00 00 00 00
PAGE 35: 00 00 00 00
PAGE 36: 00 00 00 00
PAGE 37: 00 00 00 00
PAGE 38: 00 00 00 00
PAGE 39: 00 00 00 00
PAGE 40: 00 00 00 BD
PAGE 41: 07 00 00 00
PAGE 42: 80 05 00 00
PAGE 43: 00 00 00 00
PAGE 44: 00 00 00 00

771

Re: DaVinci Junior cartridge reset

Use the card info posted here.  Make sure to change Page 08 to actually match the instructable at 5A505000

Page 14: Should match the instructable as well at 30333338.

We have now seen this 2 or 3 times were after a few resets it gives spool error.  The last time the issue was everything was good except page 14 was the old data.  I'm kinda guessing that this number has something to do with the color and it needs to match perfectly with something I'm guessing in page 8.  It also could be tracking the tag based on this number, but last time once this was changed the card worked again. 

Try changing the 2 pages above and report back. 

If that doesn't work we might want to try taking someone else dump and copying pages 8 to 14.  It might be using one of those pages to track the card usage. 

I'm also wondering if there is a simple if the same card is used in a certain number of times in row and counts up to a certain footage it errors out. 

Anyone who has been through a few reset please update up with any of your observations. 

IF you been through multiple resets have you used other card between uses ect.

772 (edited by jenne 2016-04-01 06:31:09)

Re: DaVinci Junior cartridge reset

Tried with these two changings, no sucess....

Just saw the new picture in the instructable, i had the old one.

I will check it again this evening.

773

Re: DaVinci Junior cartridge reset

jenne wrote:

Hi, 

i bought the key and was able to reset the tag two times. However now it isn't working any more. I had changed every possible value to the ones from the sample tag in the manual and had also tried every possible combination with the colors/lenghts,  but the printer always told me unknown spool when i try to open the spool statistics or try to print. 

It couldn't be the printer,  as i have a second tag (the one from the clear one,  not hacked),  which at least shows the statistics and with wich i was able to start a final print,  as there had been 1 meter left.

I had attached the tag readout from the no longer working one. Could someone with a working tag please check this and tell me,  if maybe there is a mistake in it?


IN your screenshot, you're missing a page 2C. this should contain the password ack bytes and some other things. Also page 2B should contain your password. Or is that never shown? I still need to break my password.

774

Re: DaVinci Junior cartridge reset

Did anybody tried to remove the lock bit from the tag but leave everything else in place? I'm wondering how the printer/tag  would react on that. I don't know what the tag would do is the printer sends the password but it is not necessary to read/write the tag

775

Re: DaVinci Junior cartridge reset

@maartenva

yes ppl have removed the lock byte and the printer wont accept the card.
yes ppl have cloned the data to a new card and that don't work because they don't have the pack value ( I assume not tested this my self. ).
yes most obvious things have been tryed and documented here. smile

sry if this seems rude but as you said in your first post you have read this thread and all the info is in here.