301 Reply by Bozotclown1970

  • Bozotclown1970
  • Bozotclown1970
  • Member
  • Offline
  • From: USA
  • Registered: 2016-01-05
  • Posts: 1,518

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456 wrote:
Bozotclown1970 wrote:
mjf55 wrote:

Yeah, Its been asked.  You cannot use any NTAG213 because we do not know how to generate the Password / Pack Code.  We know it is partially based on the UID, but have not figured it out.  That is ONE reason for getting the PACK CODE data back, the hope that it can be discovered.  BUT, I do not think anyone is working it.


Definitely will not work. I have some tags here and I tried everything but could not generate the pack code. Don't waste your time or money.

Ok, I thought might work with those special "blank" tags on ebay?
I´ve used those for door-locks before but now I´ve forgotten what exactly the "blank" part is smile, I think it was the UID that had to be changed to copy the original tags.


You can copy all of the data from an original tag except the UID. That is written by the manufacturer and cannot be modified. If we knew how to calculate the Pack Code you could use them. I'll bet your door locks did not check for a Pack Code.

302 Reply by Bozotclown1970

  • Bozotclown1970
  • Bozotclown1970
  • Member
  • Offline
  • From: USA
  • Registered: 2016-01-05
  • Posts: 1,518

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456 wrote:
Bozotclown1970 wrote:
Daniel456 wrote:

Sure, I´ll do a fast print and upload a new dump in 20 minutes or so


How big would a complete dump be. Would it be possible to zip it up and email it?

It´s a 4MByte eeprom but since it´s mostly FF´s and 00´s it a 3KByte RAR file smile

I meant to attach the first file to a previous post but I must have missed to click on the "Add file" button after I selected the file sad

I have attached both files to this post instead.

The info about the 2nd tag I used is as follows:
KEY = F9 10 0B C4
ID = 0x04 0xE2 0x96 0x8A 0x3E 0x4D 0x80
PACK = DD 77
SERIAL = GBP3UCA67R0769
Clear Blue
87m left

http://soliforum.com/i/?1yMfB82.png

So on this one the length is 87 as you said.

303 Reply by Daniel456

  • Daniel456
  • Member
  • Offline
  • Registered: 2017-08-21
  • Posts: 54

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Bozotclown1970 wrote:
Daniel456 wrote:
Bozotclown1970 wrote:

Definitely will not work. I have some tags here and I tried everything but could not generate the pack code. Don't waste your time or money.

Ok, I thought might work with those special "blank" tags on ebay?
I´ve used those for door-locks before but now I´ve forgotten what exactly the "blank" part is smile, I think it was the UID that had to be changed to copy the original tags.


You can copy all of the data from an original tag except the UID. That is written by the manufacturer and cannot be modified. If we knew how to calculate the Pack Code you could use them. I'll bet your door locks did not check for a Pack Code.

The cards I bought had a blank and writable UID space, so I was able to copy the door lock keys from one of the largest security firms in the world, so I think they have all the protection possible.

The "only" problem with copying the keys-tags was getting physical access to them.

304 Reply by Daniel456

  • Daniel456
  • Member
  • Offline
  • Registered: 2017-08-21
  • Posts: 54

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Bozotclown1970 wrote:
Daniel456 wrote:
Bozotclown1970 wrote:

How big would a complete dump be. Would it be possible to zip it up and email it?

It´s a 4MByte eeprom but since it´s mostly FF´s and 00´s it a 3KByte RAR file smile

I meant to attach the first file to a previous post but I must have missed to click on the "Add file" button after I selected the file sad

I have attached both files to this post instead.

The info about the 2nd tag I used is as follows:
KEY = F9 10 0B C4
ID = 0x04 0xE2 0x96 0x8A 0x3E 0x4D 0x80
PACK = DD 77
SERIAL = GBP3UCA67R0769
Clear Blue
87m left

http://soliforum.com/i/?1yMfB82.png

So on this one the length is 87 as you said.

Ok, does this help any?

I've got two more working tags that I can try but I guess you´ve already gotten the information you wanted?

305 Reply by Bozotclown1970

  • Bozotclown1970
  • Bozotclown1970
  • Member
  • Offline
  • From: USA
  • Registered: 2016-01-05
  • Posts: 1,518

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456 wrote:
Bozotclown1970 wrote:
Daniel456 wrote:

Ok, I thought might work with those special "blank" tags on ebay?
I´ve used those for door-locks before but now I´ve forgotten what exactly the "blank" part is smile, I think it was the UID that had to be changed to copy the original tags.


You can copy all of the data from an original tag except the UID. That is written by the manufacturer and cannot be modified. If we knew how to calculate the Pack Code you could use them. I'll bet your door locks did not check for a Pack Code.

The cards I bought had a blank and writable UID space, so I was able to copy the door lock keys from one of the largest security firms in the world, so I think they have all the protection possible.

The "only" problem with copying the keys-tags was getting physical access to them.


Wow, I have not been able to find any of those. Do you remember where you bought them?

306 Reply by Daniel456 (edited by Daniel456 2017-08-30 22:17:53)

  • Daniel456
  • Member
  • Offline
  • Registered: 2017-08-21
  • Posts: 54

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Bozotclown1970 wrote:
Daniel456 wrote:
Bozotclown1970 wrote:

You can copy all of the data from an original tag except the UID. That is written by the manufacturer and cannot be modified. If we knew how to calculate the Pack Code you could use them. I'll bet your door locks did not check for a Pack Code.

The cards I bought had a blank and writable UID space, so I was able to copy the door lock keys from one of the largest security firms in the world, so I think they have all the protection possible.

The "only" problem with copying the keys-tags was getting physical access to them.


Wow, I have not been able to find any of those. Do you remember where you bought them?

The ones I got are all over ebay:
http://www.ebay.com/itm/10PCS-UID-Chang … 2228762332

But those are not NTAG213 though.

Doing a quick search on ebay I can´t find NTAG213´s with writable block 0, so I´m not sure they exist.

307 Reply by Bozotclown1970

  • Bozotclown1970
  • Bozotclown1970
  • Member
  • Offline
  • From: USA
  • Registered: 2016-01-05
  • Posts: 1,518

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456 wrote:
Bozotclown1970 wrote:
Daniel456 wrote:

The cards I bought had a blank and writable UID space, so I was able to copy the door lock keys from one of the largest security firms in the world, so I think they have all the protection possible.

The "only" problem with copying the keys-tags was getting physical access to them.


Wow, I have not been able to find any of those. Do you remember where you bought them?

The ones I got are all over ebay:
http://www.ebay.com/itm/10PCS-UID-Chang … 2228762332

But those are not NTAG213 though.

Doing a quick search on ebay I can´t find NTAG213´s with writable block 0, so I´m not sure they exist.

I odn't know how I missed these. Thank you very much for everything you have shared.

308 Reply by Daniel456

  • Daniel456
  • Member
  • Offline
  • Registered: 2017-08-21
  • Posts: 54

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Bozotclown1970 wrote:
Daniel456 wrote:
Bozotclown1970 wrote:

Wow, I have not been able to find any of those. Do you remember where you bought them?

The ones I got are all over ebay:
http://www.ebay.com/itm/10PCS-UID-Chang … 2228762332

But those are not NTAG213 though.

Doing a quick search on ebay I can´t find NTAG213´s with writable block 0, so I´m not sure they exist.

I odn't know how I missed these. Thank you very much for everything you have shared.

No worries, just PM me your address for the bill wink

I´ve not read about RFID stuff for a couple of years so I don´t remember much, but could it be possible to get those "blanks" to act like NTAG213 cards?

I have a few of them here but I don´t have the software used to program them, that was a job I did for someone that didn´t let me keep the software, I actually got a laptop sent to me that had plugged up USB-ports that he remotely controlled via it´s built in 3G modem while I took care of the hardware, he was really concerned about keeping his keys secret smile

309 Reply by Bozotclown1970

  • Bozotclown1970
  • Bozotclown1970
  • Member
  • Offline
  • From: USA
  • Registered: 2016-01-05
  • Posts: 1,518

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

I just ordered some. When I get them I will see if I can do anything with them. If I can I will give you some software to work with.

310 Reply by cgrillo

  • cgrillo
  • cgrillo
  • Member
  • Offline
  • From: UK
  • Registered: 2016-06-14
  • Posts: 929

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456 wrote:
Bozotclown1970 wrote:
mjf55 wrote:

Yeah, Its been asked.  You cannot use any NTAG213 because we do not know how to generate the Password / Pack Code.  We know it is partially based on the UID, but have not figured it out.  That is ONE reason for getting the PACK CODE data back, the hope that it can be discovered.  BUT, I do not think anyone is working it.


Definitely will not work. I have some tags here and I tried everything but could not generate the pack code. Don't waste your time or money.

Ok, I thought might work with those special "blank" tags on ebay?
I´ve used those for door-locks before but now I´ve forgotten what exactly the "blank" part is smile, I think it was the UID that had to be changed to copy the original tags.

Any blank tags need to be NTAG213s.
I have looked and looked but nobody creates these... the only solution that I found was the EMUTAG.

311 Reply by mjf55 (edited by mjf55 2017-08-31 15:02:40)

  • mjf55
  • Member
  • Offline
  • From: Raleigh, NC
  • Registered: 2017-06-01
  • Posts: 336

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456 wrote:

What would happens if I changed the first pages in the tag that is the UID?
Would the printer think that is another tag or would it figure out the UID is fake since the key and pack is the same?

Otherwise I "could" change page 00 and 01 a hundred times and see what happens?
"could" = if I get the time to do it, I´ve got a bunch of work to do and I´ll probably get other things to do in a couple of days too...

I could check tomorrow if the printer adds the tag to the eeprom directly when it´s found or if it only does that after the first print, if it´s added directly it wouldn´t take too long to add 100 tags.

This got me thinking.  What would happen if you changed the remaining length fields on both the eprom and tag back to the 300M.  Since tag and eprom now match, would it work?  Or get the unidentified spool error.  Is this something you can do?

312 Reply by Daniel456

  • Daniel456
  • Member
  • Offline
  • Registered: 2017-08-21
  • Posts: 54

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

mjf55 wrote:
Daniel456 wrote:

What would happens if I changed the first pages in the tag that is the UID?
Would the printer think that is another tag or would it figure out the UID is fake since the key and pack is the same?

Otherwise I "could" change page 00 and 01 a hundred times and see what happens?
"could" = if I get the time to do it, I´ve got a bunch of work to do and I´ll probably get other things to do in a couple of days too...

I could check tomorrow if the printer adds the tag to the eeprom directly when it´s found or if it only does that after the first print, if it´s added directly it wouldn´t take too long to add 100 tags.

This got me thinking.  What would happen if you changed the remaining length fields on both the eprom and tag back to the 300M.  Since tag and eprom now match, would it work?  Or get the unidentified spool error.  Is this something you can do?

If someone can tell me exactly what and where I should change (so I don´t have to figure out how to calculate checksums etc) I can try to change the eeprom back.

But I think 200m is better since I can´t get rid of the 300 of 200m thing.

313 Reply by Bozotclown1970

  • Bozotclown1970
  • Bozotclown1970
  • Member
  • Offline
  • From: USA
  • Registered: 2016-01-05
  • Posts: 1,518

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456 wrote:
mjf55 wrote:
Daniel456 wrote:

What would happens if I changed the first pages in the tag that is the UID?
Would the printer think that is another tag or would it figure out the UID is fake since the key and pack is the same?

Otherwise I "could" change page 00 and 01 a hundred times and see what happens?
"could" = if I get the time to do it, I´ve got a bunch of work to do and I´ll probably get other things to do in a couple of days too...

I could check tomorrow if the printer adds the tag to the eeprom directly when it´s found or if it only does that after the first print, if it´s added directly it wouldn´t take too long to add 100 tags.

This got me thinking.  What would happen if you changed the remaining length fields on both the eprom and tag back to the 300M.  Since tag and eprom now match, would it work?  Or get the unidentified spool error.  Is this something you can do?

If someone can tell me exactly what and where I should change (so I don´t have to figure out how to calculate checksums etc) I can try to change the eeprom back.

But I think 200m is better since I can´t get rid of the 300 of 200m thing.


Change only the circle pages in the attach jpg.


http://soliforum.com/i/?EM2EpSy.jpg

314 Reply by Daniel456

  • Daniel456
  • Member
  • Offline
  • Registered: 2017-08-21
  • Posts: 54

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Bozotclown1970 wrote:

Change only the circle pages in the attach jpg.


http://soliforum.com/i/?EM2EpSy.jpg

Oh, I meant in the eeprom.

I change the tag with my Arduino.

Btw, what software is that screenshot from?

315 Reply by Bozotclown1970

  • Bozotclown1970
  • Bozotclown1970
  • Member
  • Offline
  • From: USA
  • Registered: 2016-01-05
  • Posts: 1,518

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456 wrote:
Bozotclown1970 wrote:

Change only the circle pages in the attach jpg.

Oh, I meant in the eeprom.

I change the tag with my Arduino.

Btw, what software is that screenshot from?


If you have already modified the tag? If so go into the eeprom and zero out the tag ID and length to zeroes. From the dumps you posted I can show you again what to zero out. Once these are zeroed in the eeprom I would think the tag would look like a new tag.

http://soliforum.com/i/?hph0yZY.jpg

The software is some software I wrote for updating tags.

316 Reply by Daniel456

  • Daniel456
  • Member
  • Offline
  • Registered: 2017-08-21
  • Posts: 54

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Bozotclown1970 wrote:

Change only the circle pages in the attach jpg.

If you have already modified the tag? If so go into the eeprom and zero out the tag ID and length to zeroes. From the dumps you posted I can show you again what to zero out. Once these are zeroed in the eeprom I would think the tag would look like a new tag.

http://soliforum.com/i/?hph0yZY.jpg

But that is exactly what I´ve done before, just reset both eeprom and tag, and we already know that works.

What I thought mfg55 wanted me to do is leave the tag ID in the eeprom but reset the counter to 200m, and reset the tag.

317 Reply by mjf55

  • mjf55
  • Member
  • Offline
  • From: Raleigh, NC
  • Registered: 2017-06-01
  • Posts: 336

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

I was just thinking to make the tag and eprom residual filament the same
  Probably the easiest is to take a tag that you already used some of, therefore the count will be less that 300 or 200 and reset that tag and make the eprom show the same count.  That way, we may just be able to rewrite the existing UID all them time

318 Reply by Bozotclown1970

  • Bozotclown1970
  • Bozotclown1970
  • Member
  • Offline
  • From: USA
  • Registered: 2016-01-05
  • Posts: 1,518

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

mjf55 wrote:

I was just thinking to make the tag and eprom residual filament the same
  Probably the easiest is to take a tag that you already used some of, therefore the count will be less that 300 or 200 and reset that tag and make the eprom show the same count.  That way, we may just be able to rewrite the existing UID all them time


I am getting totally confused. Wouldn't the  tag and the eeprom always be the same length? The only way they should be different is if you reset the tag and if you do that it would be much easier to just reset the eeprom.

319 Reply by mjf55

  • mjf55
  • Member
  • Offline
  • From: Raleigh, NC
  • Registered: 2017-06-01
  • Posts: 336

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Bozotclown1970 wrote:
mjf55 wrote:

I was just thinking to make the tag and eprom residual filament the same
  Probably the easiest is to take a tag that you already used some of, therefore the count will be less that 300 or 200 and reset that tag and make the eprom show the same count.  That way, we may just be able to rewrite the existing UID all them time


I am getting totally confused. Wouldn't the  tag and the eeprom always be the same length? The only way they should be different is if you reset the tag and if you do that it would be much easier to just reset the eeprom.

Yes, you are correct.  What I would like to see is to take a used tag.  If Daniel uses that tag data you have in your screen shot, he will need to make a small print to 'make it used'  .  Now, the remaining data field will be less than 200/300 ( which ever you start with)
I propose to reset the TAG back to maximum ( 200/300 ) ( just reload all the data again )  AND change the EEPROM remaining data field also back to ( 200/300 ) .  At the end of this, the tag and eprom match, but is reset again. 
Based on what we think we know ( or speciffically what I think I know wink )  this SHOULD work.

Did I clear up the confusion?  Daniel you?

320 Reply by Bozotclown1970

  • Bozotclown1970
  • Bozotclown1970
  • Member
  • Offline
  • From: USA
  • Registered: 2016-01-05
  • Posts: 1,518

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

I agree that should work, but at that point isn't it easier to just remove the tag from the eeprom by entering zeroes and being done with it?

321 Reply by mjf55

  • mjf55
  • Member
  • Offline
  • From: Raleigh, NC
  • Registered: 2017-06-01
  • Posts: 336

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Bozotclown1970 wrote:

I agree that should work, but at that point isn't it easier to just remove the tag from the eeprom by entering zeroes and being done with it?

Where's the fun in that?  Yeah, as Homestar Runner says,  "Your probably right"

322 Reply by Daniel456

  • Daniel456
  • Member
  • Offline
  • Registered: 2017-08-21
  • Posts: 54

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

I figure that since removing the tag from the eeprom and resetting the tag works, then just changing both back to 200m has to work too.

It´s already proven that the only place the printer saves data about the spools are in the eeprom, and with the latest files I uploaded it´s clear that the data is only in 1 place.

So I´ll skip this test.

Any other thoughts?

Has anyone else removed the eeprom yet?, or do you all have jr´s?

323 Reply by mjf55

  • mjf55
  • Member
  • Offline
  • From: Raleigh, NC
  • Registered: 2017-06-01
  • Posts: 336

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456 wrote:

I figure that since removing the tag from the eeprom and resetting the tag works, then just changing both back to 200m has to work too.

It´s already proven that the only place the printer saves data about the spools are in the eeprom, and with the latest files I uploaded it´s clear that the data is only in 1 place.

So I´ll skip this test.

Any other thoughts?

Has anyone else removed the eeprom yet?, or do you all have jr´s?

I agree.  No other thoughts. 
I have a Jr, but have not yet removed the eeprom.  I have an EMUtag and I have been using that.  I am still considering it. 

Thanks for all the data and experiments you have performed.

324 Reply by Bozotclown1970

  • Bozotclown1970
  • Bozotclown1970
  • Member
  • Offline
  • From: USA
  • Registered: 2016-01-05
  • Posts: 1,518

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

Daniel456 wrote:

I figure that since removing the tag from the eeprom and resetting the tag works, then just changing both back to 200m has to work too.

It´s already proven that the only place the printer saves data about the spools are in the eeprom, and with the latest files I uploaded it´s clear that the data is only in 1 place.

So I´ll skip this test.

Any other thoughts?

Has anyone else removed the eeprom yet?, or do you all have jr´s?


I have a Jr, but I can't find the eeprom on it.

325 Reply by magnusjjj

  • magnusjjj
  • Member
  • Offline
  • Registered: 2017-08-23
  • Posts: 41

Re: XYZ Printing Da Vinci Jr (w) / Da Vinci Mini (w) Hacking

I can now verify that is seems like the firmware sits unencrypted on that eeprom. It *might* just be the recovery rom, but in it exists cleartext names of commands for the printer, along with some RTOS stuff. I have tried grabbing strings from it and testing it out, but not found anything yet.