326

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Ok, so I just found the eeprom on my JR board. When I receive my reader I will attempt to de-solder it and see what I can read from it.

327 (edited by mjf55 2017-09-02 01:45:50)

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

magnusjjj wrote:

I can now verify that is seems like the firmware sits unencrypted on that eeprom. It *might* just be the recovery rom, but in it exists cleartext names of commands for the printer, along with some RTOS stuff. I have tried grabbing strings from it and testing it out, but not found anything yet.

I think you are mistaken.  The eeprom we are discussing is used for UID / Spool SNs / and remaining length on that spool.  We have review the actual eprom dump and that is all that is on there.  See attached files from Daniel456 a page or 2 back.

328

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Bozotclown1970 wrote:

Ok, so I just found the eeprom on my JR board. When I receive my reader I will attempt to de-solder it and see what I can read from it.

Where is it?  What reader are you getting?

329 (edited by Bozotclown1970 2017-09-02 02:00:17)

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

mjf55 wrote:
Bozotclown1970 wrote:

Ok, so I just found the eeprom on my JR board. When I receive my reader I will attempt to de-solder it and see what I can read from it.

Where is it?  What reader are you getting?


Right, wrong or indifferent this is the one I ordered:

http://www.ebay.com/itm/201316582787


Sorry the picture is so dark but it is night time here. I believe this is the JR eeprom:


http://soliforum.com/i/?6pHTOi8.jpg

330

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

No problem.  Thanks for the picture.  I believe that is it also.

331 (edited by magnusjjj 2017-09-02 06:11:11)

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

mjf55 wrote:
magnusjjj wrote:

I can now verify that is seems like the firmware sits unencrypted on that eeprom. It *might* just be the recovery rom, but in it exists cleartext names of commands for the printer, along with some RTOS stuff. I have tried grabbing strings from it and testing it out, but not found anything yet.

I think you are mistaken.  The eeprom we are discussing is used for UID / Spool SNs / and remaining length on that spool.  We have review the actual eprom dump and that is all that is on there.  See attached files from Daniel456 a page or 2 back.

He gave me the whole rom, some 4mb in size uncompressed.
The firmware starts from 0x2000.
For a sample, lets take a look at one of the, *probable*, .rodata sections. A list of commands and responses smile.

Edit:
It just swallowed the image.

https://drive.google.com/file/d/0B0HS1n … sp=sharing

332

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

magnusjjj wrote:

He gave me the whole rom, some 4mb in size uncompressed.
The firmware starts from 0x2000.
For a sample, lets take a look at one of the, *probable*, .rodata sections. A list of commands and responses smile.

Edit:
It just swallowed the image.

https://drive.google.com/file/d/0B0HS1n … sp=sharing

Ok, Im confused.  The rom Daniel posted had FF's at 0x2000.
Can you post or share the whole rom you got?  Is this one Daniel gave you?

333

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

The one Daniel gave me. I am not sure I can post it. There is some sort of serial number in it. He will have to decide if he feels comfortable with it. (not trying to be an arse, but outing his serial number seems crossing a line. I would dump mine, but not quite got the hang of desoldering those chips without destroying them. (I have.. done so before. Not pleasant)

334

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Hi.

Just a quick update, we had the calculated date of birth of our daughter today, last wednesday we did a check-up and everything looked just fine, but yesterday we found out that our daughter was dead so we have spent the last day in the hospital and just got home.

Because of this I will not be very active in this thread for a while.

Regarding the eeprom dumps.

The ones I have posted here was from a printer with firmware 1.0.6, and I posted them for the purpose of finding where the printer stores spool-info.
And it seems like firmware 1.0.6 only uses the eeprom for the spools.

The dump that magnusjjj is talking about is from my other mini w that has the latest firmware, that is the one I posted a screenshot of that contained a whole lot more than just the spool-info.

I have told magnusjjj to erase what he thinks is a serial-number from the dump, after that he can post the file here.

335

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

So sorry to hear about your loss. Our prayers are with you.

336

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Yes, very sorry for your loss.  My prayers are with you and your family.

337

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

For the business part: https://drive.google.com/file/d/0B0HS1n … sp=sharing <-- That is the link to the firmware. Looks like i was wrong about the serial. I just royally screwed up desoldering it and destroyed the chip, but it looks like the printer actually boots without it. Will have to test resetting and toying with it without the chip.

For the personal part, Daniel:

I am so sorry for your loss. Come back if you feel like its a good distraction, but otherwise, nobody expects you to be on your feet. Take care of yourself, and your family.

338

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

magnusjjj wrote:

For the business part: https://drive.google.com/file/d/0B0HS1n … sp=sharing <-- That is the link to the firmware. Looks like i was wrong about the serial. I just royally screwed up desoldering it and destroyed the chip, but it looks like the printer actually boots without it. Will have to test resetting and toying with it without the chip.

For the personal part, Daniel:

I am so sorry for your loss. Come back if you feel like its a good distraction, but otherwise, nobody expects you to be on your feet. Take care of yourself, and your family.


What country are you in? I just received 50 chips from China yesterday and I could part with one, but I am in the US.

339

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Bozotclown1970 wrote:
magnusjjj wrote:

For the business part: https://drive.google.com/file/d/0B0HS1n … sp=sharing <-- That is the link to the firmware. Looks like i was wrong about the serial. I just royally screwed up desoldering it and destroyed the chip, but it looks like the printer actually boots without it. Will have to test resetting and toying with it without the chip.

For the personal part, Daniel:

I am so sorry for your loss. Come back if you feel like its a good distraction, but otherwise, nobody expects you to be on your feet. Take care of yourself, and your family.


What country are you in? I just received 50 chips from China yesterday and I could part with one, but I am in the US.

Sweden smile. Might order a few in a couple of days. First though, I am gonna try and see if it works without the chip. It boots, that much is clear. Might just be the recovery mode that is borked?

340

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Confirmed, it actually works without the eeprom. Zero clues. Bozot, did you try it? I just found out my android update broke NFC support, also relapse, so no clue how to test how it impacts rolls.

341

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

magnusjjj wrote:

Confirmed, it actually works without the eeprom. Zero clues. Bozot, did you try it? I just found out my android update broke NFC support, also relapse, so no clue how to test how it impacts rolls.

Very interesting.  What firmware level is your printer?
Have you tried another spool in there.  I would assume that it would work.  I also assume that it will still update the spool tag, but his may be able to let you just re-program the same tag over and over.

342

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

I can confirm that both my printers, one with 1.0.6 and one with 1.1.9 both starts, prints a 1st time, and prints a 2nd time without the eeprom connected.

I have not tried to reset the tags yet, I will see if I have time to try that later tonight or so.

But I see no reason why that shouldn´t work, so if it does, all you have to do is cut the eeprom out if you want to reset tags or use emutag.

Unless there is a new firmware released that depends on the eeprom for some reason.

343

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

That is amazing! Good work to everyone! big_smile.

344 (edited by Bozotclown1970 2017-09-03 12:18:26)

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

magnusjjj,

I have not tried tacking my eeprom out yet. I am running firmware 2.2.4 and can still reset my tags, but I do have an extra mother board I bought from a guy.

Have you tried running the XYZ software with your printer attached to your computer? When I briefly looked through that eeprom yesterday and it looked like there may be some variables/variable names stored in it. That may just be some garbage they threw out there to throw hackers off track.

345

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Bozotclown1970 wrote:

magnusjjj,

I have not tried tacking my eeprom out yet. I am running firmware 2.2.4 and can still reset my tags, but I do have an extra mother board I bought from a guy.

Have you tried running the XYZ software with your printer attached to your computer? When I briefly looked through that eeprom yesterday and it looked like there may be some variables/variable names stored in it. That may just be some garbage they threw out there to throw hackers off track.

No, it definately looked like there was code in the dump. To the point where I am extremely surprised at it working without it.

Would try putting idapro on one of a likely looking blocks, but.. my energylevels are toast.
It does have free/openrtos in there, along with all the strings for answers to the protocols. Very confusing.

346

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Where we may run into issues is when you lose power or as you mentioned try to do an upgrade to firmware. Have you tried to go through the menu options on the printer?

347

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456 wrote:

I can confirm that both my printers, one with 1.0.6 and one with 1.1.9 both starts, prints a 1st time, and prints a 2nd time without the eeprom connected.

I have not tried to reset the tags yet, I will see if I have time to try that later tonight or so.

But I see no reason why that shouldn´t work, so if it does, all you have to do is cut the eeprom out if you want to reset tags or use emutag.

Unless there is a new firmware released that depends on the eeprom for some reason.

And right now both printers are printing without eeproms, and with their tags reset to 300m.

In other words, they don´t need the eeprom at all, just cut it´s legs and reset the tags with a cheap Arduino and PN532 shield, or use emutag.

So $12-13 US and a sharp knife is all you need, oh and the password for your tag.

Unless of course this is stopped in a future firmware.

This is with a Mini w, not the JR, unless someone has tried it on a JR yet?

348

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456 wrote:

Unless there is a new firmware released that depends on the eeprom for some reason.

I would guess that the code that is in the eeprom is there for either an upgrade or downgrade.

349

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Bozotclown1970 wrote:

Where we may run into issues is when you lose power or as you mentioned try to do an upgrade to firmware. Have you tried to go through the menu options on the printer?


Menu options? smile. On the mini w, no options, apart from in xyzware. All those report everything is fine.
Heck, even the recovery mode seems to work, though I have not actually tried to *use* it yet.

I wrote some arduino code to reset a tag automatically, with this:

https://www.kjell.com/se/sortiment/el-v … ino-p87911

For the non-swedish folk, thats about 10 euros for a RC522 arduino shield with some extra tags and shit bundled.
So, uhm.. like 25$ in total for a tag resetter solution? big_smile. gently unsolder just the two data pins on the chip (so if we are super duper wrong about something, super easy to fix). Get your hands on a 10 euro arduino, and the 10 euro shield, and 5$ for a tag password. Bam. Solved.

(I have to try if my solution works, wink. But that will have to wait for.. uhm. Like 8 hours for my stuuuupid print to finish up)

350

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

That's what you get for using your printer!  big_smile