Stratasys Dimension SST 768 Hacking

The Dimension SST 768 is one hell of a machine, but has one major setback besides its initial price – it’s professional prototyping, what can you say? – the price of P400 ABS material cartridges. These can cost up to $260 each, whereas you can easily purchase your own spools of ABS and HIPS (support material) for no more than $40-50 per 1kg spool in most cases (PP3DP’s material is some of the best available). Anyway, on to the actual hack.

Now, all of this would not have been possible without HaveBlue and his post over at that details a few key points about these printers (it may work for more than just the SST 768, please let me know if anyone tries it!). On a side note, I would definitely recommend checking out a few of his other posts on 3D printing. I also would like to thank my friend Ian/puppyofkosh for all his help on investigating the EEPROM of various cartridges – his knowledge of programming and hexadecimal was invaluable.

A quick explanation of how the printer keeps track of how much material is remaining is in order. The amount of remaining material in a cartridge is saved in an EEPROM chip (DS2433) on a small PCB that connects directly to the printer. This is a 512 byte (4kb) EEPROM with a hex value for how much material the cartridge has left – the problem being that it’s encrypted by some unique value, probably the serial number. Second, the printer itself keeps a running list of what cartridges have been inserted and expended throughout its lifetime.

The main idea is to dump a cartridge’s EEPROM at 100%, let it reach 5-10% through regular use (doesn’t exactly matter what value it reaches, that’s up to you), and then write back your 100% dump to the same cartridge, thereby preserving the encryption. In addition, it would be nice if the file (/system.dat,  and in some cases /mariner/config/system.dat)  that keeps track of used cartridges could be deleted on boot. Luckily, the printer runs Linux (RHEL 8), so that should make things a bit easier and more familiar.

Required hardware:

  • Phillips screwdriver.
  • Serial cable, nothing fancy.
  • IDE to USB adapter (required if you do not have any IDE ports on your computer’s motherboard, recommended even if you do as it does make life a little easier)

The way this can be accomplished is as follows:

  1. Take out the hard drive from the 3D printer (very easily accessible, just unscrew the 3 screws on the side door).
  2. Make an image of the drive using “dd” – an excellent program that works extremely well.
  3. UPDATE: If you are using Windows, download a program called Win32DiskImager and use that to create a backup image of the hard drive instead of following the below – it should be much easier. Also, be sure to check the simplified guide (with a pre-made image coming soon) here:
  4. Using Virtualbox or your virtualization software of choice, restore the image you made of the hard drive into a VM. If you are using Virtualbox, I would suggest using the VBoxManage tool to convert the raw image to a VDI, and then using that VDI as a hard drive attached to a virtual machine in Virtualbox.
  5. Change the root password however you want (I manually edited /etc/shadow from a LiveCD in the virtual machine, you can type “linux single” into the LILO prompt before booting up the system and issuing passwd, etc.)
  6. Make the necessary edits to rc.local to delete the system.dat file(s) on boot, enable SSH (not necessary, but may be helpful in the future) by adding another entry to rc.local, and edit iptables to allow SSH.
  7. Create an image of the virtual machine you just made all of the changes in. I would recommend booting a LiveCD in the VM, and using dd with a pipe to gzip (with a further pipe to scp/ftp if you wish, although the image should only come out to ~870mb when compressed – easily fitting into the LiveCD’s temporary RAM storage).
  8. Take this newly created, compressed image, and use “gzip -dc” with a pipe to “dd” to image the printer’s physical hard drive. Alternatively, you could have imaged the drive directly from the LiveCD in the virtual machine (something like dd if=/dev/sda of=/dev/sdc where /dev/sdc is the printer’s physical hard drive that you attached to the VM.)
  9. Put the hard drive back into the printer, and turn it on. With any luck, it should boot and you should have SSH access to it. If it does not boot, restore the vanilla image back to a VM, and try again.  If you do not have SSH access, make sure you edited iptables correctly – keep in mind those lines are processed in order! Add the line allowing connections to port 22 as high up in the list as possible.

The above is what I like to refer to as “Part I” of the hack. Moving on to Part II, now we’ll actually read and write to the cartridge’s EEPROM.

  1. This is where that serial cable listed up top comes in. Notice the serial port on the back of the printer labelled “DIAG”? That’s the diagnostic console, and it can perform extremely low level functions that even having root access doesn’t give you. Connect one end of your serial cable to the port, and the other end to some computer.
  2. I would suggest PuTTY, but I suppose HyperTerminal and other terminal emulation software would work as well. Configure your software of choice to a baud rate of 38400, 8 data bits, 1 stop bit, no parity, and XOn/XOff, hardware, or no flow control (try each until one works)
  3. If everything worked, you’ll be greeted by a very minimal console (should just be a black or white screen).
  4. Issue the following command to read the cartridge’s EEPROM: “er 0 0 512”. Replace that command with “er 1 0 512” if you wish to dump the support material cartridge’s EEPROM. Give it a few seconds, and it should print out something that looks like this. Manually copy and paste that entire chunk, and save it to a file on your local machine. Using Notepad++ (my software of choice), or any other text-editing program, format the file so that it looks like this, a comma-separated, one-line string of hex values. You can safely remove the “Model Cartridge ID” and any such other extraneous text. Please note, as stated earlier, my 100% dump will not work for your cartridge’s EEPROM chip as each has a different serial number that is used to encrypt the data on it (Thank you, Ian).
  5. Using Notepad++ (although one could also write a quick Perl script to sift through the data and format it as needed) it is actually quite easy to format the file as needed. By using Alt+Click+Drag, you enter column select mode, and can easily remove the columns on each side. Next, use the search and replace function in Notepad++ to search for and remove all “\n”, and “\r” characters, replacing them with spaces. You should now have a space-separated, single-line string of hex values. Simply use the search and replace function one more time to replace all spaces with commas, and then put a double-quote at each end.I made a quick JavaScript tool to automate formatting EEPROM dumps so they can be written back.
  6. Keep this file around for when your cartridge reaches a low percentage of remaining material, and then issue the following command via the console: “ew 0 0 {your comma-separated, double-quote enclosed 100% dump from the same cartridge here}”. Replace with “ew 1 0 {data}” if you wish to write your previous support material dump to the support material EEPROM.
  7. Reboot the printer, and voila – you’re back to 100%! Just make sure to re-spool the cartridge, and you’re good to go!

So, what just happened during those last two steps? You overwrote the near-empty value on the cartridge’s EEPROM with its previous 100% dump/value. Since the dump came from the same cartridge (albeit earlier in time), the unique encryption key is preserved, and the cartridge is ready to be used again. Upon rebooting the printer, the printer starts up, deletes the system.dat file(s), and sees the cartridge you are using as a brand new one that has never been used before. At last, your newly re-spooled cartridge is ready to print again!

I’d love to hear any tips, alternate methods, and/or experiences in the comments. However, your standard disclaimer applies: I am not responsible for any damage to any of your hardware.


Tagged , , , , , , , , , , , , , , , . Bookmark the permalink.

122 Responses to Stratasys Dimension SST 768 Hacking

  1. This website definitely has all the info I needed concerning this
    subject and didn’t know who to ask.

  2. max says:

    Hi, can you tell me what changes you made to start sshd?
    I changed the iptables rules to allow the port 22, but with any change i make to the rc.local file (/etc/rc.d/rc.local) the printer doesn’t boot.

  3. VEERA says:

    i need more information about this please verify me as soon as possiable

  4. Andrew says:


    I’ve been using this amazing tutorial for months, but after many refills I’ve come across this problem: it seems that cartridges had a limited refill number of 6 times. After that, refill is impossible.

    When I try to write my cartridge with the command:
    ew 0 0 0 “…………………..”

    The reply error is very long (see the attached link) but the key line is:
    “PClassMaterial.cpp:163:INFO:Cartridge communication error:material write fail limit of 6 exceeded on Model cartridge”

    Anybody came across to this problem to?

    Thank to you all!

    See the complete error here:

  5. Christoph says:

    Hi! Is this also possible with a FDM Titan? An older model?

  6. danirock says:

    Hi Brian,
    could you send me the file

    Thanks in advance.
    Best Regards,

    • Brian says:

      Hi Dani – Sorry I didn’t see your post until today (12/28). I still have the zip file that was originally posted on the site but I do not know how to attach it to a message. So if you are still in need of the file and you know the instructions for attaching it I will check for a reply.

      Best regards,

  7. Lauren says:

    I am trying to set up this printer, and am looking for a driver for windows 8. Any such thing exist?

  8. garion says:

    Any chance someone can send me the Insight software? I have a SST1200es and I want to try make it think it is a Fortus 250.

  9. Edt says:

    My stratasys dimension 1200es ran into an error 14, 66 when booting up.. Does anyone know what the issue is? And how to resolve it?

Leave a Reply

Your email address will not be published.