Simplified 3D Printer Hacking

As the post title says, this post details a much easier way of hacking the printer. While simpler, there are a few caveats:

  • No SSH/remote access to the printer.
  • No root access.

So if you simply want to be able to refill your own cartridges and don’t really care about having remote access to the printer, read on!

Required hardware:

  • Phillips screwdriver.
  • Serial cable, nothing fancy.
  • IDE to USB adapter (required if you do not have any IDE ports on your computer’s motherboard, recommended even if you do as it does make life a little easier)

The way this can be accomplished is as follows:1. Create and boot a VirtualBox virtual machine with a LiveCD (preferably Knoppix so you can exactly follow the rest of the tutorial). Alternatively, if you are already running some variant of Linux, simply turn on your computer and start following the tutorial starting at #7.

To perform a backup (highly recommended, albeit not 100% necessary. Skip down to the next section if you want to skip backing up the drive.):

UPDATE: You can download a program called Win32DiskImager and simply read the disk into an IMG file in Windows instead of the need to do everything below in order to backup the hard drive.

1. Make sure you create a VM with at least a 40GB virtual HDD (this is so we can store the actual backup image of the drive).
<show pictures here>

2. Select Devices in the Virtualbox VM window’s toolbar, and click the printer’s hard drive to connect it to the virtual machine.

3. At this point, issue “sudo fdisk -l” in LXTerminal and locate the printer’s hard drive (it should have many partitions) – you’ll need this for the next step.

4. Launch GParted (click the LXDE icon in the bottom left corner, select preferences, and click GParted). Alternatively, you can launch GParted by issuing “gksudo gparted” in LXTerminal.

5. Create a partition table on and format the VM’s virtual hard drive – NOT the printer’s hard drive. Make doubly sure that you are formatting the correct drive (the VDI should be completely unformatted right now, whereas the printer’s HDD has many partitions).

6. If the virtual hard drive/VDI isn’t already mounted, issue the following commands:

“sudo mkdir /media/virtualhdd”
“sudo mount /dev/sda1 /media/virtualhdd”
This varies according to every machine, but is usually /dev/sda1 in a vanilla LiveCD with virtual hard drive case such as this. GParted should be able to give you this information if it’s different – it may be /dev/hda1 or /dev/sdc1 or something like that. Just make sure you are mounting the virtual hard drive (HDD belonging to/created by Virtualbox), and not the printer’s physical hard drive.

7. After formatting and mounting the VM’s hard drive correctly, issue “sudo dd if=/dev/sdb of=/media/virtualhdd/printer_backup.img”. Please keep in mind that your drive may not be called /dev/sdb – verify its identifier via either fdisk or GParted (although you should have seen it earlier). dd can take some time to run (especially because we’re copying each and every bit with no compression), so this would be a good time to grab some coffee.

8. To save space, I would definitely suggest compressing the image (you could have done this inline via “dd if=/dev/hdx | gzip > /path/to/image.gz”), but I prefer compressing the image after the backup process. Anyway, issue “sudo gzip /media/virtualhdd/printer_backup.img /media/virtualhdd/printer_backup.img.gz” to compress the image into another file. You can now safely delete the original file (printer_backup.img).

9. To transfer the backup file off of the VM, you have a variety of options. Use scp/sftp/ftp/cifs/nfs/samba to transfer it to another computer, upload it to Google Drive/Filedropper/any filehost, or share your local drive with the virtual machine. Strictly speaking, you can leave it in the VM and have it be backed up that way, but many may prefer a more accessible/reliable form of storage.

The simple way of hacking the drive (simply modifying one file, no need to restore it to another VM):

1. Almost exactly like before, you will be mounting a hard drive. However, this time, you will be mounting the printer’s hard drive and NOT the virtual hard drive.

2. Issue “sudo fdisk -l” in LXTerminal and locate the printer’s hard drive (it should have many partitions), or launch GParted and locate it that way (do NOT format anything – simply look up the name of the drive in the dropdown).

3. Again, just like before, issue the following commands in LXTerminal (albeit with slight changes):

“sudo mkdir /media/sdb1”
“sudo mount /dev/sdb1 /media/sdb1”

“sudo nano /media/sdb1/etc/rc.local”

4. Add the lines “rm -f /system.dat” and “rm -f /mariner/config/system.dat” without the quotes, and save the file.

5. We’re done! Power down the virtual machine/your Linux computer, safely remove/eject the drive, and put it in back in the printer.

Part II:

  1. Connect the serial cable to the port on the back of the printer labelled “DIAG”.
  2. Download PuTTY and configure it to connect with a baud rate of 38400, 8 data bits, no parity, 1 stop bits, and hardware flow control.
  3. You should now be greeted by a very rudimentary console, or more correctly – nothing should appear.
  4. Issue the following command to read the cartridge’s EEPROM: “er 0 0 512″. Replace that command with “er 1 0 512″ if you wish to dump the support material cartridge’s EEPROM. Give it a few seconds, and it should print out something that looks like this. Manually copy and paste that entire chunk, and save it to a file on your local machine.
  5. Use the tool to correctly format the hexadecimal data for writeback.
  6. Save the output somewhere on your computer so you can continuously write back the 100% dump to the cartridge.
  7. Issue the following command via the console: “ew 0 0 {your comma-separated, double-quote enclosed 100% dump from the same cartridge here}”. (Replace with “ew 1 0 {data}” if you wish to write your previous support material dump to the support material EEPROM.)
  8. Reboot the printer, and voila – you’re back to 100%! Just make sure to re-spool the cartridge, and you’re good to go!

So, what just happened during those last two steps? You overwrote the near-empty value on the cartridge’s EEPROM with its previous 100% dump/value. Since the dump came from the same cartridge (albeit earlier in time), the unique encryption key is preserved, and the cartridge is ready to be used again. Upon rebooting the printer, the printer starts up, deletes the system.dat file(s), and sees the cartridge you are using as a brand new one that has never been used before. At last, your newly re-spooled cartridge is ready to print again!

*Pictures/screenshots coming soon*

I’d love to hear any tips, alternate methods, and/or experiences in the comments. However, your standard disclaimer applies: I am not responsible for any damage to any of your hardware.

Tagged , , , , , , , , , , , , , , , , , . Bookmark the permalink.

119 Responses to Simplified 3D Printer Hacking

  1. garion says:

    Any chance someone can send me the Insight software? I have a SST1200es and I want to try make it think it is a Fortus 250.

  2. Tsucasa says:

    Did you upload the image to a better hosting site?
    I’ve got a Dimension BST 768 that I’d like to use it on.

  3. William says:

    Dear all,
    I’ve a HP Designjet Color 3D printer, I’m trying to connect via serial cable to the printer but I’ve no reply from the printer once I send “er 0 0 0 128” or all the other strings that I found in the article, anyone can help me?

    Cheers
    William

  4. Lew Crenshaw says:

    Any chance that you can re-post the maracaEX software? I need it to update my BST1200. Thanks in advance.

  5. Tony says:

    HI,
    I have found a few typos… the er code is er 0 0 0 512 not er 0 0 512
    I am also very confused an how to format the dump back to the machine..

    ew 0 0 {“”81,e8,4e,cf,4d,b5,71,8c,13,fb,64,f2,1c,ab,61,72,a2,f3,34,c9,2f,43,ad,18,91,62,5d,33,64,ab,c1,cb,53,cb,96,98,78,a8,18,3b,60,89,cf,83,3f,8b,7a,c7,60,89,cf,83,3f,8b,7a,c7,d1,78,d8,76,2b,c3,26,36,4b,41,00,00,00,00,10,eb,55,aa,55,63,9a,20,6d,be,84,f6,00,00,00,00,00,00,bb,b0,3e,53,9c,7f,11,eb,28,49,0d,07,01,93,cf,bf,53,54,52,41,54,41,53,59,53,04,17,36,14,69,1e,35,84,8b,44,40,56,b8,cc,48,d3,eb,4d,66,51,8f,67,64,5e,fa,95,34,18,87,98,85,6f,68,a1,bf,99,3a,86,c5,2d,4e,b3,9e,1f,c7,0d,a1,0e,7b,09,c0,1c,61,22,6b,c6,20,af,d6,13,74,f1,14,79,fd,a7,54,8e,90,4b,7c,e0,87,90,94,4b,09,a2,62,d0,b0,c4,7c,cc,8e,b4,cc,be,ab,cd,dc,1a,8f,91,21,04,43,43,24,70,5e,7d,c8,f8,d3,75,8b,6a,e9,f3,f2,ce,cb,c3,ed,ca,cb,f4,4c,f0,7f,b2,e8,d5,28,3d,6a,99,dc,be,29,69,1a,4e,18,6a,3b,a3,37,23,a1,b5,e6,e7,eb,e0,64,82,ac,a6,32,26,ec,13,6c,e5,29,d7,77,70,39,5a,39,4f,88,0f,a0,9a,fb,bd,e6,96,b0,fe,6b,a1,2a,0f,d2,db,95,84,e1,00,a8,1c,f8,bc,cb,43,80,54,1b,68,31,9b,bc,8f,f1,c9,95,6a,3e,cd,0c,cd,8d,26,3b,09,e4,d3,12,01,23,64,7f,dd,27,1b,56,87,99,fb,a5,d2,56,17,26,a4,a1,ac,4f,0f,84,c3,ce,6d,c3,9f,b2,8e,39,d3,b4,89,f0,32,24,85,ff,d0,c8,e1,96,27,ce,26,17,8b,52,19,fb,2c,11,30,dc,ad,15,ef,79,bc,27,97,4f,d8,bb,61,20,da,92,dc,b0,23,e1,59,9c,91,96,ed,14,8c,d0,1c,48,fb,f6,4f,54,ba,44,ab,dd,71,68,82,d3,6a,58,c4,4e,07,96,c6,be,ee,e2,f1,95,88,2b,ba,e5,fc,a3,e5,b8,b4,8c,90,3a,07,41,c5,6e,f9,80,d5,39,fa,12,c0,9b,29,df,22,82,ea,da,a5,72,00,bb,1f,e1,24,7c,f5,8d,62,02,7c,a8,5f,57,7a,50,d2,f3,be,38,ef,69,2e,b3,d2,23,30,71,2e,14,57,3b,73,10,c8,ad,d7,38,16,30,2c,47,0a,7c,d0,92,6a,1b,””} like this?

  6. calvin says:

    I have a dimension sst 1200es with a dead hard drive, can anyone help me out with am image I can use to restore the machine

    I had the machine working for a few weeks and I should have backed up the drive when I first got it working

    thank you
    C

  7. Does it work for the uPrint SE Plus?

  8. Kaelan says:

    Hello everybody,

    We have gone through these steps to setup our dimension sst1200es printer and had several successful rewrites to some printer cartridges that we had around 60% during the time of the setup.

    We recently got two brand new cartridges and copied their code to be used for rewriting after they were installed. Now its about a month later and we have emptied both of our cartridges and have tried rewriting the data back which was sucessful, but when we reboot and reinstall the cartridge the printer tells us that it is empty. We have checked and the system.dat file is deleted from both locations at boot. Is there a problem created when we run the cartridge all the way down to 0% or is there another location where the cartridge ID is stored when they are emptied?

  9. Louis Loizides says:

    I can’t connect using Putty and the settings given here… I’ll try another USB to serial adapter as soon as I have a chance, but just to verify – do I need to be in maintenance mode or anything?

  10. saturn says:

    Dear All
    I have a dimension SST and I would like to refill the model and support material.
    “version 4.2 build 1400”

    I have succeded to connect the printer via PuTTy.
    it work fine
    if I type the in command I get this:

    Set Dual Port Mem to zero.
    Cout = 12
    Cin = 28
    Cverticies = 44
    Status = 60
    StatusEnd = 164
    finished Initialize Dual Port Memory.
    finished setting Dual Port Memory globals.
    PLD version= c2
    Modeling head motor initialized.
    Support Head motor initialized.
    PWM set point= 0
    PWM2 set point= 0
    Reset initialization cold boot.
    Normal reset
    NVRAM base address = 4800
    Rev B 186 Board.
    XY axis initialized.
    Z axis initialized.
    Valid data verified in non volatile ram.
    Max ticks late = -49
    …..Received IN_SERVICE
    From command channel
    Set Dual Port Mem to zero.
    Cout = 12
    Cin = 28
    Cverticies = 44
    Status = 60
    StatusEnd = 164
    finished Initialize Dual Port Memory.
    finished setting Dual Port Memory globals.
    PLD version= c2
    Modeling head motor initialized.
    Support Head motor initialized.
    PWM set point= 0
    PWM2 set point= 0
    Reset initialization hot boot.
    Normal reset
    NVRAM base address = 4800
    Rev B 186 Board.
    XY axis initialized.
    Z axis initialized.
    Valid data verified in non volatile ram.
    Received CL_SERVICE: 1
    Max ticks late = -49

    other command from the service guide are also working.

    but:

    help command answer:
    Unrecognized command at Serial Port was….

    and I have no acces to the EEprom materiel memory with er command.
    I tried all these following thing but none are working

    .er 0 0 512
    Received ER_SERVICE: 0
    read eeprom: 0
    sending eeprom data
    er 0 0 0 512
    Received ER_SERVICE: 0
    read eeprom: 0
    sending eeprom data
    er 1 0 512
    Received ER_SERVICE: 1
    read eeprom: 1
    sending eeprom data
    er 0 0 0 128
    Received ER_SERVICE: 0
    read eeprom: 0
    sending eeprom data
    er 0 0 0 512
    Received ER_SERVICE: 0
    read eeprom: 0
    sending eeprom data
    er 0 0 256
    Received ER_SERVICE: 0
    read eeprom: 0
    sending eeprom data
    er 0 0 0 256
    Received ER_SERVICE: 0
    read eeprom: 0
    sending eeprom data
    .er 0 0 2
    Received ER_SERVICE: 0
    read eeprom: 0
    sending eeprom data

    The case is same as “Cedric”
    What wrong?
    Can I upgrade the software, and how to do it?

    best regards
    Saturn

  11. cedric says:

    Dear all,
    I own a prodigy plus and I would like refill model and support material.
    the soft. version is 7.1 and the build version 1922

    I have succeded to connect the printer via PuTTy.
    it work fine
    if I type the in command I get this:


    Received IN_SERVICE
    From serial port
    Set Dual Port Mem to zero.
    Cout = 12
    Cin = 28
    Cverticies = 44
    Status = 60
    StatusEnd = 164
    finished Initialize Dual Port Memory.
    finished setting Dual Port Memory globals.
    Firmware Version= 1922
    Firmware Build= 0
    PLD version= c2
    Modeling head motor initialized.
    Support Head motor initialized.
    PWM set point= 0
    PWM2 set point= 0
    Reset initialization hot boot.
    Normal reset
    NVRAM base address = 4800
    Rev B 186 Board.
    XY axis initialized.
    Z axis initialized.
    Valid data verified in non volatile ram.
    Max ticks late = -49

    other command from the service guide are also working.

    but:

    help command answer:
    Unrecognized command at Serial Port was….

    and I have no acces to the EEprom materiel memory with er command.
    I tried all these following thing but none are working


    ” er 0 0 512

    Received ER_SERVICE: 0
    read eeprom: 0
    sending eeprom data

    ” er 1 0 512

    Received ER_SERVICE: 1
    read eeprom: 1
    sending eeprom data

    ” er 0 0 0 128

    Received ER_SERVICE: 0
    read eeprom: 0
    sending eeprom data

    ” er 0 0 0 512

    Received ER_SERVICE: 0
    read eeprom: 0
    sending eeprom data

    “er 0 0 256

    Received ER_SERVICE: 0
    read eeprom: 0
    sending eeprom data

    ” er 0 0 0 256

    Received ER_SERVICE: 0
    read eeprom: 0
    sending eeprom data

    ” er 0 0 2

    Received ER_SERVICE: 0
    read eeprom: 0
    sending eeprom data

    machine answer
    Received ER_SERVICE: 0
    read eeprom: 0
    sending eeprom data

    and nothing else until I press enter and it give
    “Unrecognized command at Serial Port was….

    What wrong?
    Can I upgrade the software, and how to do it?

    Best regards

    cedric

  12. random bloke says:

    Hi,

    just writing to confirm that this hack does work on a Stratasys/Uprint machine branded as “HP Designjet Color 3D Printer”

    However, the chip has only 128bit.

    read out is therefore obtained by:
    er 0 0 0 128

    write back:
    ew 0 0 0 {data}

    With our setup there are some issues with writing the dump back. Sometimes the wrong code is written to the chip so it is best to read out the chip to make sure it contains the right values before rebooting the printer. This might be down to a dodgy cable or putty. Not sure yet.

    It seems that chips are not allowed to be completely emptied in order to restore them.

    However, many thanks for sharing the hack.

Leave a Reply

Your email address will not be published.