Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking
Ok, so I just found the eeprom on my JR board. When I receive my reader I will attempt to de-solder it and see what I can read from it.
You are not logged in. Please login or register.
SoliForum - 3D Printing Community → XYZ Printing Hacks & Mods → XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking
Ok, so I just found the eeprom on my JR board. When I receive my reader I will attempt to de-solder it and see what I can read from it.
I can now verify that is seems like the firmware sits unencrypted on that eeprom. It *might* just be the recovery rom, but in it exists cleartext names of commands for the printer, along with some RTOS stuff. I have tried grabbing strings from it and testing it out, but not found anything yet.
I think you are mistaken. The eeprom we are discussing is used for UID / Spool SNs / and remaining length on that spool. We have review the actual eprom dump and that is all that is on there. See attached files from Daniel456 a page or 2 back.
Ok, so I just found the eeprom on my JR board. When I receive my reader I will attempt to de-solder it and see what I can read from it.
Where is it? What reader are you getting?
Bozotclown1970 wrote:Ok, so I just found the eeprom on my JR board. When I receive my reader I will attempt to de-solder it and see what I can read from it.
Where is it? What reader are you getting?
Right, wrong or indifferent this is the one I ordered:
http://www.ebay.com/itm/201316582787
Sorry the picture is so dark but it is night time here. I believe this is the JR eeprom:

No problem. Thanks for the picture. I believe that is it also.
magnusjjj wrote:I can now verify that is seems like the firmware sits unencrypted on that eeprom. It *might* just be the recovery rom, but in it exists cleartext names of commands for the printer, along with some RTOS stuff. I have tried grabbing strings from it and testing it out, but not found anything yet.
I think you are mistaken. The eeprom we are discussing is used for UID / Spool SNs / and remaining length on that spool. We have review the actual eprom dump and that is all that is on there. See attached files from Daniel456 a page or 2 back.
He gave me the whole rom, some 4mb in size uncompressed.
The firmware starts from 0x2000.
For a sample, lets take a look at one of the, *probable*, .rodata sections. A list of commands and responses
.
Edit:
It just swallowed the image.
He gave me the whole rom, some 4mb in size uncompressed.
The firmware starts from 0x2000.
For a sample, lets take a look at one of the, *probable*, .rodata sections. A list of commands and responses.
Edit:
It just swallowed the image.
Ok, Im confused. The rom Daniel posted had FF's at 0x2000.
Can you post or share the whole rom you got? Is this one Daniel gave you?
The one Daniel gave me. I am not sure I can post it. There is some sort of serial number in it. He will have to decide if he feels comfortable with it. (not trying to be an arse, but outing his serial number seems crossing a line. I would dump mine, but not quite got the hang of desoldering those chips without destroying them. (I have.. done so before. Not pleasant)
Hi.
Just a quick update, we had the calculated date of birth of our daughter today, last wednesday we did a check-up and everything looked just fine, but yesterday we found out that our daughter was dead so we have spent the last day in the hospital and just got home.
Because of this I will not be very active in this thread for a while.
Regarding the eeprom dumps.
The ones I have posted here was from a printer with firmware 1.0.6, and I posted them for the purpose of finding where the printer stores spool-info.
And it seems like firmware 1.0.6 only uses the eeprom for the spools.
The dump that magnusjjj is talking about is from my other mini w that has the latest firmware, that is the one I posted a screenshot of that contained a whole lot more than just the spool-info.
I have told magnusjjj to erase what he thinks is a serial-number from the dump, after that he can post the file here.
So sorry to hear about your loss. Our prayers are with you.
Yes, very sorry for your loss. My prayers are with you and your family.
For the business part: https://drive.google.com/file/d/0B0HS1n … sp=sharing <-- That is the link to the firmware. Looks like i was wrong about the serial. I just royally screwed up desoldering it and destroyed the chip, but it looks like the printer actually boots without it. Will have to test resetting and toying with it without the chip.
For the personal part, Daniel:
I am so sorry for your loss. Come back if you feel like its a good distraction, but otherwise, nobody expects you to be on your feet. Take care of yourself, and your family.
For the business part: https://drive.google.com/file/d/0B0HS1n … sp=sharing <-- That is the link to the firmware. Looks like i was wrong about the serial. I just royally screwed up desoldering it and destroyed the chip, but it looks like the printer actually boots without it. Will have to test resetting and toying with it without the chip.
For the personal part, Daniel:
I am so sorry for your loss. Come back if you feel like its a good distraction, but otherwise, nobody expects you to be on your feet. Take care of yourself, and your family.
What country are you in? I just received 50 chips from China yesterday and I could part with one, but I am in the US.
magnusjjj wrote:For the business part: https://drive.google.com/file/d/0B0HS1n … sp=sharing <-- That is the link to the firmware. Looks like i was wrong about the serial. I just royally screwed up desoldering it and destroyed the chip, but it looks like the printer actually boots without it. Will have to test resetting and toying with it without the chip.
For the personal part, Daniel:
I am so sorry for your loss. Come back if you feel like its a good distraction, but otherwise, nobody expects you to be on your feet. Take care of yourself, and your family.
What country are you in? I just received 50 chips from China yesterday and I could part with one, but I am in the US.
Sweden
. Might order a few in a couple of days. First though, I am gonna try and see if it works without the chip. It boots, that much is clear. Might just be the recovery mode that is borked?
Confirmed, it actually works without the eeprom. Zero clues. Bozot, did you try it? I just found out my android update broke NFC support, also relapse, so no clue how to test how it impacts rolls.
Confirmed, it actually works without the eeprom. Zero clues. Bozot, did you try it? I just found out my android update broke NFC support, also relapse, so no clue how to test how it impacts rolls.
Very interesting. What firmware level is your printer?
Have you tried another spool in there. I would assume that it would work. I also assume that it will still update the spool tag, but his may be able to let you just re-program the same tag over and over.
I can confirm that both my printers, one with 1.0.6 and one with 1.1.9 both starts, prints a 1st time, and prints a 2nd time without the eeprom connected.
I have not tried to reset the tags yet, I will see if I have time to try that later tonight or so.
But I see no reason why that shouldn´t work, so if it does, all you have to do is cut the eeprom out if you want to reset tags or use emutag.
Unless there is a new firmware released that depends on the eeprom for some reason.
That is amazing! Good work to everyone!
.
magnusjjj,
I have not tried tacking my eeprom out yet. I am running firmware 2.2.4 and can still reset my tags, but I do have an extra mother board I bought from a guy.
Have you tried running the XYZ software with your printer attached to your computer? When I briefly looked through that eeprom yesterday and it looked like there may be some variables/variable names stored in it. That may just be some garbage they threw out there to throw hackers off track.
magnusjjj,
I have not tried tacking my eeprom out yet. I am running firmware 2.2.4 and can still reset my tags, but I do have an extra mother board I bought from a guy.
Have you tried running the XYZ software with your printer attached to your computer? When I briefly looked through that eeprom yesterday and it looked like there may be some variables/variable names stored in it. That may just be some garbage they threw out there to throw hackers off track.
No, it definately looked like there was code in the dump. To the point where I am extremely surprised at it working without it.
Would try putting idapro on one of a likely looking blocks, but.. my energylevels are toast.
It does have free/openrtos in there, along with all the strings for answers to the protocols. Very confusing.
Where we may run into issues is when you lose power or as you mentioned try to do an upgrade to firmware. Have you tried to go through the menu options on the printer?
I can confirm that both my printers, one with 1.0.6 and one with 1.1.9 both starts, prints a 1st time, and prints a 2nd time without the eeprom connected.
I have not tried to reset the tags yet, I will see if I have time to try that later tonight or so.
But I see no reason why that shouldn´t work, so if it does, all you have to do is cut the eeprom out if you want to reset tags or use emutag.
Unless there is a new firmware released that depends on the eeprom for some reason.
And right now both printers are printing without eeproms, and with their tags reset to 300m.
In other words, they don´t need the eeprom at all, just cut it´s legs and reset the tags with a cheap Arduino and PN532 shield, or use emutag.
So $12-13 US and a sharp knife is all you need, oh and the password for your tag.
Unless of course this is stopped in a future firmware.
This is with a Mini w, not the JR, unless someone has tried it on a JR yet?
Unless there is a new firmware released that depends on the eeprom for some reason.
I would guess that the code that is in the eeprom is there for either an upgrade or downgrade.
Where we may run into issues is when you lose power or as you mentioned try to do an upgrade to firmware. Have you tried to go through the menu options on the printer?
Menu options?
. On the mini w, no options, apart from in xyzware. All those report everything is fine.
Heck, even the recovery mode seems to work, though I have not actually tried to *use* it yet.
I wrote some arduino code to reset a tag automatically, with this:
https://www.kjell.com/se/sortiment/el-v … ino-p87911
For the non-swedish folk, thats about 10 euros for a RC522 arduino shield with some extra tags and shit bundled.
So, uhm.. like 25$ in total for a tag resetter solution?
. gently unsolder just the two data pins on the chip (so if we are super duper wrong about something, super easy to fix). Get your hands on a 10 euro arduino, and the 10 euro shield, and 5$ for a tag password. Bam. Solved.
(I have to try if my solution works,
. But that will have to wait for.. uhm. Like 8 hours for my stuuuupid print to finish up)
That's what you get for using your printer! ![]()
SoliForum - 3D Printing Community → XYZ Printing Hacks & Mods → XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking
Powered by PunBB, supported by Informer Technologies, Inc.