Stratasys Dimension SST 768 Hacking

The Dimension SST 768 is one hell of a machine, but has one major setback besides its initial price – it’s professional prototyping, what can you say? – the price of P400 ABS material cartridges. These can cost up to $260 each, whereas you can easily purchase your own spools of ABS and HIPS (support material) for no more than $40-50 per 1kg spool in most cases (PP3DP’s material is some of the best available). Anyway, on to the actual hack.

Now, all of this would not have been possible without HaveBlue and his post over at haveblue.org that details a few key points about these printers (it may work for more than just the SST 768, please let me know if anyone tries it!). On a side note, I would definitely recommend checking out a few of his other posts on 3D printing. I also would like to thank my friend Ian/puppyofkosh for all his help on investigating the EEPROM of various cartridges – his knowledge of programming and hexadecimal was invaluable.

A quick explanation of how the printer keeps track of how much material is remaining is in order. The amount of remaining material in a cartridge is saved in an EEPROM chip (DS2433) on a small PCB that connects directly to the printer. This is a 512 byte (4kb) EEPROM with a hex value for how much material the cartridge has left – the problem being that it’s encrypted by some unique value, probably the serial number. Second, the printer itself keeps a running list of what cartridges have been inserted and expended throughout its lifetime.

The main idea is to dump a cartridge’s EEPROM at 100%, let it reach 5-10% through regular use (doesn’t exactly matter what value it reaches, that’s up to you), and then write back your 100% dump to the same cartridge, thereby preserving the encryption. In addition, it would be nice if the file (/system.dat,  and in some cases /mariner/config/system.dat)  that keeps track of used cartridges could be deleted on boot. Luckily, the printer runs Linux (RHEL 8), so that should make things a bit easier and more familiar.

Required hardware:

  • Phillips screwdriver.
  • Serial cable, nothing fancy.
  • IDE to USB adapter (required if you do not have any IDE ports on your computer’s motherboard, recommended even if you do as it does make life a little easier)

The way this can be accomplished is as follows:

  1. Take out the hard drive from the 3D printer (very easily accessible, just unscrew the 3 screws on the side door).
  2. Make an image of the drive using “dd” – an excellent program that works extremely well.
  3. UPDATE: If you are using Windows, download a program called Win32DiskImager and use that to create a backup image of the hard drive instead of following the below – it should be much easier. Also, be sure to check the simplified guide (with a pre-made image coming soon) here:
  4. Using Virtualbox or your virtualization software of choice, restore the image you made of the hard drive into a VM. If you are using Virtualbox, I would suggest using the VBoxManage tool to convert the raw image to a VDI, and then using that VDI as a hard drive attached to a virtual machine in Virtualbox.
  5. Change the root password however you want (I manually edited /etc/shadow from a LiveCD in the virtual machine, you can type “linux single” into the LILO prompt before booting up the system and issuing passwd, etc.)
  6. Make the necessary edits to rc.local to delete the system.dat file(s) on boot, enable SSH (not necessary, but may be helpful in the future) by adding another entry to rc.local, and edit iptables to allow SSH.
  7. Create an image of the virtual machine you just made all of the changes in. I would recommend booting a LiveCD in the VM, and using dd with a pipe to gzip (with a further pipe to scp/ftp if you wish, although the image should only come out to ~870mb when compressed – easily fitting into the LiveCD’s temporary RAM storage).
  8. Take this newly created, compressed image, and use “gzip -dc” with a pipe to “dd” to image the printer’s physical hard drive. Alternatively, you could have imaged the drive directly from the LiveCD in the virtual machine (something like dd if=/dev/sda of=/dev/sdc where /dev/sdc is the printer’s physical hard drive that you attached to the VM.)
  9. Put the hard drive back into the printer, and turn it on. With any luck, it should boot and you should have SSH access to it. If it does not boot, restore the vanilla image back to a VM, and try again.  If you do not have SSH access, make sure you edited iptables correctly – keep in mind those lines are processed in order! Add the line allowing connections to port 22 as high up in the list as possible.

The above is what I like to refer to as “Part I” of the hack. Moving on to Part II, now we’ll actually read and write to the cartridge’s EEPROM.

  1. This is where that serial cable listed up top comes in. Notice the serial port on the back of the printer labelled “DIAG”? That’s the diagnostic console, and it can perform extremely low level functions that even having root access doesn’t give you. Connect one end of your serial cable to the port, and the other end to some computer.
  2. I would suggest PuTTY, but I suppose HyperTerminal and other terminal emulation software would work as well. Configure your software of choice to a baud rate of 38400, 8 data bits, 1 stop bit, no parity, and XOn/XOff, hardware, or no flow control (try each until one works)
  3. If everything worked, you’ll be greeted by a very minimal console (should just be a black or white screen).
  4. Issue the following command to read the cartridge’s EEPROM: “er 0 0 512″. Replace that command with “er 1 0 512″ if you wish to dump the support material cartridge’s EEPROM. Give it a few seconds, and it should print out something that looks like this. Manually copy and paste that entire chunk, and save it to a file on your local machine. Using Notepad++ (my software of choice), or any other text-editing program, format the file so that it looks like this, a comma-separated, one-line string of hex values. You can safely remove the “Model Cartridge ID” and any such other extraneous text. Please note, as stated earlier, my 100% dump will not work for your cartridge’s EEPROM chip as each has a different serial number that is used to encrypt the data on it (Thank you, Ian).
  5. Using Notepad++ (although one could also write a quick Perl script to sift through the data and format it as needed) it is actually quite easy to format the file as needed. By using Alt+Click+Drag, you enter column select mode, and can easily remove the columns on each side. Next, use the search and replace function in Notepad++ to search for and remove all “\n”, and “\r” characters, replacing them with spaces. You should now have a space-separated, single-line string of hex values. Simply use the search and replace function one more time to replace all spaces with commas, and then put a double-quote at each end.I made a quick JavaScript tool to automate formatting EEPROM dumps so they can be written back.
  6. Keep this file around for when your cartridge reaches a low percentage of remaining material, and then issue the following command via the console: “ew 0 0 {your comma-separated, double-quote enclosed 100% dump from the same cartridge here}”. Replace with “ew 1 0 {data}” if you wish to write your previous support material dump to the support material EEPROM.
  7. Reboot the printer, and voila – you’re back to 100%! Just make sure to re-spool the cartridge, and you’re good to go!

So, what just happened during those last two steps? You overwrote the near-empty value on the cartridge’s EEPROM with its previous 100% dump/value. Since the dump came from the same cartridge (albeit earlier in time), the unique encryption key is preserved, and the cartridge is ready to be used again. Upon rebooting the printer, the printer starts up, deletes the system.dat file(s), and sees the cartridge you are using as a brand new one that has never been used before. At last, your newly re-spooled cartridge is ready to print again!

I’d love to hear any tips, alternate methods, and/or experiences in the comments. However, your standard disclaimer applies: I am not responsible for any damage to any of your hardware.

 

Tagged , , , , , , , , , , , , , , , . Bookmark the permalink.

92 Responses to Stratasys Dimension SST 768 Hacking

  1. Hey there I am so excited I found your blog, I really found you by mistake, while I
    was looking on Aol for something else, Nonetheless I am here now
    and would just like to say thanks a lot for a fantastic post
    and a all round entertaining blog (I also love the theme/design), I don’t have time to browse it all at the minute but I have book-marked it and also added in your RSS
    feeds, so when I have time I will be back to
    read more, Please do keep up the awesome job.

  2. Hi,

    Need to know if this hack is valid for uPrint SE Plus.

    Another question is where I can find ABS P430 to refill.

    Thanks.

  3. Oliviero says:

    Hello guys, Thank you for the tutorial, it is amazing, i just had a little problem in connecting trhough the serial port, s i’ve used arduino instead, wort a program to rewrite the eeprom, inserted the arduino in the cartiridge and connetcted to the eeprom, so now you just need to power on the arduino reprgram the eeprom

    • Dylann says:

      Do you have a copy of the program you wrote with your arduino? I would love to see a tutorial on how to hack the printer using the arduino since I am also having problems accessing the serial port on the printer as well.

  4. ebswift says:

    I’m having some real trouble with this process, I have been able to successfully read the eeprom values and have a clone of the hard drive that works on other drives. This machine is a Dimension Elite.

    My problem is that when I mount the drive using gparted terminal, or ubuntu the printer won’t boot. If I re-image the drive from the backup and put it straight in the printer it consistently boots. Since I can’t mount the drive I can’t actually implement the hack.

    I have tried booting the drive directly in virtualbox and nothing works, it just keeps coming up with ‘no init found’ regardless of whether I’m booting off the drive or an image. Therefore I’ve resorted to simply mounting the drive to change the required files, but as I say, the mount process changes “something”…

    • ebswift says:

      After days of trying I solved my own issue 5 minutes after posting about it… typical. Anyway, the Elite HDD is SATA, connecting with a USB SATA connector to UBUNTU for some reason instantly stops the drive from being recognised at the printer. Same if the physical drive is mounted to virtualbox with the vmdk added as an IDE (as was outlined in comments and instructions). I’ve found one and only one thing that works that will NOT corrupt the drive:

      Add the vmdk as a SATA to the virtual machine. Put in a physical GPARTED dvd and let the vm boot on that, accepting all the options. Go into the terminal and mount the drive and make the edits, all will be well.

  5. Casquito says:

    Works great for me. I’m connecting to the DIAG port with an ipad and a RedPark cable using thje GetConsole app. Works great.
    Thanks

  6. Jason D says:

    We need help.. We will pay for anyone that can walk us through this. Email me at jason dolbin (at) yahoo dot com.

  7. Louis Loizides says:

    I tried going through these instructions yesterday – got the VM loaded and changed the root password. But there were a few funny things – the drive had like 10 partitions (off the top of my head). I wasn’t expecting that, but mounted what I believe is the root one and changed the root password. But then there was no system.dat file in either the root directory or /mariner/config (there’s a mariner directory, but not mariner.config). I ran find but didn’t find any system.dat file on the partition. Does anyone have any ideas? Our tech replaced the firmware a few months ago and I’m wondering if the newer version screwed me over for this hack. Maybe if I can plug a monitor in the back of the printer I’ll try to take a look to figure out where the cartridge data is being stored.

    • STEPPING3D says:

      I am trying to do this on a prodigy plus but just like the OP I can’t find the system.dat files by browsing the drive with hidden files displayed, they don’t seem to be where they should? be.. If anyone has any suggestions or experiences applying this workaround on a machine other than the dimension it would be much appreciated. The dimension and prodigy plus images are very similar partition and data wise but the dimension is roughly 40 gig and the prodigy is 20 gig. Any ideas???

  8. Tanny says:

    Just by reprogramming the EEPROM in cartridge it wont work??
    not doing anything to 3D printer?
    And if I use EEPROM of some other printer’s exhausted cartridge will it work?
    I am willing to purchase the material asap so help friend.

  9. Niklas says:

    My Printer (Dimension SST 768) only gives me something like:
    sending eeprom Data

    but nothing appears any one could help me???

  10. Peterko says:

    Could anyone advise where to buy extruder for 1200es as replacement?
    The same is also for the uPrint.

  11. Makhmud says:

    I have “Dimension sst1200es” 3D printer. After the voltage source reset suddenly the printer givinig me message “Starting up. Finding home” to lcd display. What should I do? Can anybody help me?
    It looks like the ‘XY axis not ready’

  12. Alejandro says:

    Save some money and potential frustration by going with Argyle Materials. Replacement spool & EEPROM chip for $195/spool and no real hassles. Our facility has all of the necessary equipment to characterize material properties, though we have not had a chance to compare Stratasys’ vs. others. Once the warranty runs out on our machine, we plan to cease using Stratasys OEM materials entirely (assuming Argyle’s claims of greater material properties are verified).

    • screw you says:

      argyle / agile are a bunch of crooks….stay away from these guys.

      makerbot sells stratasys P430/m30 for less than $50/kg now so why pay $150 more for knock off material?

Leave a Reply

Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong> <pre class="">