Simplified 3D Printer Hacking

As the post title says, this post details a much easier way of hacking the printer. While simpler, there are a few caveats:

  • No SSH/remote access to the printer.
  • No root access.

So if you simply want to be able to refill your own cartridges and don’t really care about having remote access to the printer, read on!

Required hardware:

  • Phillips screwdriver.
  • Serial cable, nothing fancy.
  • IDE to USB adapter (required if you do not have any IDE ports on your computer’s motherboard, recommended even if you do as it does make life a little easier)

The way this can be accomplished is as follows:1. Create and boot a VirtualBox virtual machine with a LiveCD (preferably Knoppix so you can exactly follow the rest of the tutorial). Alternatively, if you are already running some variant of Linux, simply turn on your computer and start following the tutorial starting at #7.

To perform a backup (highly recommended, albeit not 100% necessary. Skip down to the next section if you want to skip backing up the drive.):

UPDATE: You can download a program called Win32DiskImager and simply read the disk into an IMG file in Windows instead of the need to do everything below in order to backup the hard drive.

1. Make sure you create a VM with at least a 40GB virtual HDD (this is so we can store the actual backup image of the drive).
<show pictures here>

2. Select Devices in the Virtualbox VM window’s toolbar, and click the printer’s hard drive to connect it to the virtual machine.

3. At this point, issue “sudo fdisk -l” in LXTerminal and locate the printer’s hard drive (it should have many partitions) – you’ll need this for the next step.

4. Launch GParted (click the LXDE icon in the bottom left corner, select preferences, and click GParted). Alternatively, you can launch GParted by issuing “gksudo gparted” in LXTerminal.

5. Create a partition table on and format the VM’s virtual hard drive – NOT the printer’s hard drive. Make doubly sure that you are formatting the correct drive (the VDI should be completely unformatted right now, whereas the printer’s HDD has many partitions).

6. If the virtual hard drive/VDI isn’t already mounted, issue the following commands:

“sudo mkdir /media/virtualhdd”
“sudo mount /dev/sda1 /media/virtualhdd”
This varies according to every machine, but is usually /dev/sda1 in a vanilla LiveCD with virtual hard drive case such as this. GParted should be able to give you this information if it’s different – it may be /dev/hda1 or /dev/sdc1 or something like that. Just make sure you are mounting the virtual hard drive (HDD belonging to/created by Virtualbox), and not the printer’s physical hard drive.

7. After formatting and mounting the VM’s hard drive correctly, issue “sudo dd if=/dev/sdb of=/media/virtualhdd/printer_backup.img”. Please keep in mind that your drive may not be called /dev/sdb – verify its identifier via either fdisk or GParted (although you should have seen it earlier). dd can take some time to run (especially because we’re copying each and every bit with no compression), so this would be a good time to grab some coffee.

8. To save space, I would definitely suggest compressing the image (you could have done this inline via “dd if=/dev/hdx | gzip > /path/to/image.gz”), but I prefer compressing the image after the backup process. Anyway, issue “sudo gzip /media/virtualhdd/printer_backup.img /media/virtualhdd/printer_backup.img.gz” to compress the image into another file. You can now safely delete the original file (printer_backup.img).

9. To transfer the backup file off of the VM, you have a variety of options. Use scp/sftp/ftp/cifs/nfs/samba to transfer it to another computer, upload it to Google Drive/Filedropper/any filehost, or share your local drive with the virtual machine. Strictly speaking, you can leave it in the VM and have it be backed up that way, but many may prefer a more accessible/reliable form of storage.

The simple way of hacking the drive (simply modifying one file, no need to restore it to another VM):

1. Almost exactly like before, you will be mounting a hard drive. However, this time, you will be mounting the printer’s hard drive and NOT the virtual hard drive.

2. Issue “sudo fdisk -l” in LXTerminal and locate the printer’s hard drive (it should have many partitions), or launch GParted and locate it that way (do NOT format anything – simply look up the name of the drive in the dropdown).

3. Again, just like before, issue the following commands in LXTerminal (albeit with slight changes):

“sudo mkdir /media/sdb1”
“sudo mount /dev/sdb1 /media/sdb1”

“sudo nano /media/sdb1/etc/rc.local”

4. Add the lines “rm -f /system.dat” and “rm -f /mariner/config/system.dat” without the quotes, and save the file.

5. We’re done! Power down the virtual machine/your Linux computer, safely remove/eject the drive, and put it in back in the printer.

Part II:

  1. Connect the serial cable to the port on the back of the printer labelled “DIAG”.
  2. Download PuTTY and configure it to connect with a baud rate of 38400, 8 data bits, no parity, 1 stop bits, and hardware flow control.
  3. You should now be greeted by a very rudimentary console, or more correctly – nothing should appear.
  4. Issue the following command to read the cartridge’s EEPROM: “er 0 0 512″. Replace that command with “er 1 0 512″ if you wish to dump the support material cartridge’s EEPROM. Give it a few seconds, and it should print out something that looks like this. Manually copy and paste that entire chunk, and save it to a file on your local machine.
  5. Use the tool to correctly format the hexadecimal data for writeback.
  6. Save the output somewhere on your computer so you can continuously write back the 100% dump to the cartridge.
  7. Issue the following command via the console: “ew 0 0 {your comma-separated, double-quote enclosed 100% dump from the same cartridge here}”. (Replace with “ew 1 0 {data}” if you wish to write your previous support material dump to the support material EEPROM.)
  8. Reboot the printer, and voila – you’re back to 100%! Just make sure to re-spool the cartridge, and you’re good to go!

So, what just happened during those last two steps? You overwrote the near-empty value on the cartridge’s EEPROM with its previous 100% dump/value. Since the dump came from the same cartridge (albeit earlier in time), the unique encryption key is preserved, and the cartridge is ready to be used again. Upon rebooting the printer, the printer starts up, deletes the system.dat file(s), and sees the cartridge you are using as a brand new one that has never been used before. At last, your newly re-spooled cartridge is ready to print again!

*Pictures/screenshots coming soon*

I’d love to hear any tips, alternate methods, and/or experiences in the comments. However, your standard disclaimer applies: I am not responsible for any damage to any of your hardware.

Tagged , , , , , , , , , , , , , , , , , . Bookmark the permalink.

119 Responses to Simplified 3D Printer Hacking

  1. Jakob says:


    Does anyone know if it works on uPrint?
    Thank you in advance!


  2. Nick says:

    I am sorry for spamming the comments section. But I wanted to give an update on my progress.

    I Got it to Work!

    Throughout all of my problems, I believe I have found what was causing so much trouble. The problem appears to be the terminal communication: reading/writing the EEPROM’s.

    While using PuTTY, I noticed (among other glitches and quirks) that the result of me pasting the modified HEX value varied. I would paste the code in (using shift + ins) and write it to the EEPROM. If I retyped the same command, exactly as before, and pasted the code, exactly the same way, the code would look different. The HEX pairs at the end of each break in PuTTY would be different. The line length varied.

    This didn’t make any sense to me, so I began reading through both commands, value by value.

    What I found was that some values would randomly be skipped.

    Lets say the correct code was : …c9,35,7a,be,56…

    When I paste the code into PuTTY it would show up as …c9,35,7be,56…

    And then if I re-entered the command, and re-pasted the code, that error would be fixed, but another one (or few) might arise.

    I have absolutely no idea what could be causing this. Perhaps it’s a lousy cable and there’s data loss (can that even happen in this way), or maybe PuTTY is trying to paste faster than it can access the memory, I have no idea. However, after pasting it and trying the same command a couple different times, I managed to get one of my cartridges to successfully show more material than it previously did!! Which is the point of this entire escapade!

    I will probably have someone read me the code as I manually key it into PuTTY from now on until I can find out why it’s acting strange.

    I would like to thank the author of this post for providing such valuable information and for assisting me with my questions and concerns. I would also like to thank everyone who commented on this post and shared their information.

    I am using a Stratasys 1200es SST Machine
    With the most current software as of November 2013

    It is definitely possible to hack these machines, so anyone reading this in the future, I wish you luck.

    • Dan says:

      Hey Nick,

      That’s awesome!! Really glad you got it to work, and thanks for providing an update + confirmation that this works on the 1200es with the latest software!

    • Charlie says:

      I have run into the same problem. I pasted the code into a wordpad document to save it, and from there repasted it into PuTTY. I came up the same error. I don’t the exact cause of the problem, my best guess is that 512bits of code is too much to putty to remember all at once and however it brakes up the code does not put it back correctly. Like I said, I’m not sure if this is the problem, but I fixed it by pasting in 2 parts. I copied in the first half then the second half and this fixed the errors.

  3. Nick says:

    I have tried everything I can think of and still can’t get it working. Perhaps there’s a new file that must be removed as well in order to get the cartridge format to stick.

    I’ve searched the entire drive for “system.dat” files and removed them all manually (through linux) and removed the xdh cache file. I’ve used the newly created EEPROM Formatter tool, which I know is formatting correctly, because when I write back the depleted code before trying to restore the cartridge, it works fine.

    After all this, whenever I flash the EEPROM back to an older HEX value and restart the machine, it gives me an error saying Material Error, Cartridge Invalid

    If anyone has any other ideas, I would really appreciate your input.

    Thank you

  4. Nick says:

    Update on my comment earlier:

    It didn’t work.

    I modified the rc.local files and deleted the system.dat files manually, and re-programmed the eeprom with an earlier readout, and when I restart the machine, it says that there is a material error and that I have to change out the material cartridge.

    I’m using a Dimension 1200es SST with what I believe to be the newest firmware. If anyone has any suggestions or can help, I would be greatly appreciative!

    Thank you all for all your help, I know I’m close with this!

    • Dan says:


      In regards to the system.dat files – try searching the entire drive for the filename “system.dat”… there may be more laying around. Also, make sure you’re writing back the data in a valid format (I’ll be revamping my EEPROM formatting to make it more reliable).

    • Kelvin says:

      Hi Nick,

      I’m in the same boat as you.

      However, the things that are different from my Dimension SST 1200 ES and yours is that mine uses the 3 argument value instead of the 4 of yours.

      What I figured out from the help command was that I did not put the double quotations from the dump program that Dan made: ( “……” ). I had read it as doing this instead: ew 0 0 {……} as shown in the instructions. This seems be the source of why my printer spitted out the “ew is not a valid command”

      I was only able to find one copy of the rc.local file to modify and that was labelled as a boot drive under GParted for me. I did start going through each partition using the “ls” command in the LXTerminal but only the main partition (sdg1 for me) had anything past /media/sdg1/etc

      Anyways, I’m trying to piece everything together. Using Dan’s program, I see that the values have been lifted from the “er 0 0 512” dump. However, those lifted values, what do they stand for? Does Dan’s program modify those values or just removes all the lines of crap code on the left and right columns and just re-edits it?

      I, too, think we are close to cracking this.


  5. Nick says:

    I am so thankful to have found this page.

    I currently work at a company in the entertainment industry and we have a Dimension 1200es SST machine. I’ve essentially been put in charge of the machine (due to the fact that I’m the only one in the shop who has any knowledge of 3D software.) I had a Dimension 1200 printer at my highschool a couple years ago, so I was familiar with the printer when they brought it into my work.

    I’m 19, and pretty tech savvy, but I found that parts of this tutorial were slightly hard to follow. I read it, and reread the entire thing probably a dozen times before actually attempting it with my machine.

    I saw other comments about the HDD in the machine being SATA instead of IDE, this is true with the 1200es model (at least mine.)

    I connected it to my computer with an old external HDD case we had in the tech cabinet, and ripped the ISO off to another HDD of the same size (250gb)

    It took hours, so be prepared.

    The next step was to boot into linux and do the file changing steps. I was slightly familiar with Linux Live USB keys, but the KNOPPIX build can ONLY be put on a CD/DVD! I tried running off a USB at first, and couldnt get it to work.

    After finally getting KNOPPIX up and running, I was able to mount the HDD. But it took a bit of tweaking. This is where I found this tutorial to be lacking some specific information. I found the name of the drive (SDF) but whenever I tried mounting it with the “mount” command, it gave me an error and said that I had to specify the filesystem type. After spending an hour or so messing with it, I realized I had to mount “SDF1” which was the name of the first partition on the drive.

    Drive successfully mounted, I began typing in the commands to modify the necessary files. Some more problems that I came across: The system.dat files were NOT located in /media/SDF1/etc it was located in a completely different partition “SDF5”

    I went poking around the HDD with a visual file explorer and found it through that means.

    The linux portion went well, and I put the HDD back in the printer and crossed my fingers that I didn’t just brick my company’s $30,000 machine. It booted up normally and all is well.

    As for the serial cable portion, I can confirm that plugging a cable into the UPS port, and then into your computer does nothing! STupid mistake on my part, we only had cables at work that plugged into the UPS port, and not the diag port (can’t remember right now which one is male and which female.) I went to our local electronic store and bought a couple cables and adapters and continued.

    I tried with a USB-serial converter, but had no luck, It was confusing trying to figure out which USB port was com1, com2, com# whatever. I took an OLD laptop (i’m talkin at least 10 years) that had a serial port on the back, and plugged the cable in, again, no luck.

    I looked at the pins on my cable and saw that they were in a “Straight Through” format, not RS232 or crossover. I cut the cable and stripped all the sub-wires inside, then re-wired them into an “RS232 Crossover with Full Handshake” format, and plugged the cable in again.


    Got a couple lines on top of the terminal with information and Stratasys/Dimension names and I figured I was in.

    The only difference I found (between my machine, and the tutorial) is that when I was entering the commands to read the eeproms, it gave me an error and said I entered a 3 argument value where it expected a 4 argument value.
    The Dimension 1200es SST (at least mine) used a 4 argument value for the eeproms
    0 0 0 512
    in stead of
    0 0 512

    Some tips about working with the terminal:

    HELP command

    simply typing “help” without the quotes into a new line of the terminal will bring up a HUGE list of commands and their correct syntaxes, I found this very useful

    When entering a command, if you enter it incorrectly, lets say you mistype one of the arguments or give it too many/too few arguments, it will bring you to a new line on the terminal; however, I have found that I got some annoying errors when I went to type the command again. I found it to be good etiquette to hit the enter key a couple times, it seems that when you use a command incorrectly, it creates a new line and allows you to enter the correct value, and then gives errors if you try to start a new command, so I just got in the habit of making sure it was on a clean, fresh line.

    OP, please consider adding some of these changes to the tutorial so that people with similar problems can see them, and so that people in the future can get more information. I will post more later if I come across any other useful information.

    Also, one of my original concerns was that Dimension/Stratasys would have this patched in an update; however, my job had a Stratasys technician out when they moved the machine into my office to readjust the head, install some new plastic bits that got broken, etc. He installed the newest firmware and said that everything was good and up to date. This was September 2013
    So I can vouch for any software prior to this date, if they fix it after this, who knows.

    Thank you again for all the information you provided! I just hacked my machine last week and ran some parts over the weekend, I will flash back the old EEPROM codes when I go back in to make sure everything works.

    Good luck everyone!

    It may seem daunting and complex, but it CAN be done!


    Once I get everything up and running with my company, we will be selling 3D printed parts (mostly to Movie studios and prop houses) but if anyone is interested in a (hopefully cheaper thanks to the OP here) alternative to shapeways, we are based out of Southern California, and I can provide a link to our printing service page (once I create it)
    Sorry for the advertising plug, I just figured it’s worth a shot, haha

    • Neil says:

      Hi Nick,

      Great to read you’ve got it working. I’ve a SST1200es to, and would like to share some of my methods.

      Instead of the serial cable to reset the eeprom chips, I use an Arduino connected to my computer. I use this program: . It automatically back-ups the eeproms and allows you to put the oldest eeprom dump back with a simple command line command.

      The thing I’m facing however, is that it doesn’t remove system.dat and xdh-cache on boot. I’m using these rules in rc.local:
      rm -f /mariner/config/system.dat
      rm -f /var/lib/stateless/state/var/lib/dbus/xdh-cache

      The thing is, when I re-flash my eeproms and reboot the machines, it gives the cartridge errors. I can however remove the harddrive, hook it up to a virtual machine running Ubuntu and remove the files by command line from Ubuntu. Would be easier tough if they got removed on startup. Would you be willing to check what rules you use in your rc.local?

      If you’re looking for another challenge: we were in the process of making it think it is a Fortus 250MC, which basically is the same machine. Need to have a copy of the 250MC harddrive tough before I can make it work.


  6. Kelvin says:

    Hi Dan,

    Just reading through your instructions for hacking the 3D printer.

    I’m looking to follow your instructions as best as I can. I am not a programmer by any means.

    Anyways, could you comment on what you mean by “serial cable, nothing fancy?” I’m looking at my local computer store’s website and can seemingly only find a USB to Female Serial cable that is: “ 1 Port USB to Null Modem RS232 DB9 Serial Dce Adapter Cable With Ftdi” All the other serial to USB cable features a male end for the serial connection.

    Also, I opened up the printer and it appears to be a Serial ATA connection and not an IDE one. For the “IDE to USB” adapter, could a drive enclosure to the same trick?


  7. Ben says:

    I have a BST 768. I did the Linux files parts but I cannot get the Serial port to work. I have what seems to be a reputable USB-RS232 adapter. It is a Geramo with FTDI chip. The drivers install automatically, it shows up as COM 7 USB Serial Port. I have tried all different types of flow control and several terminal programs. Any idea what my problem is?

    • Ben says:

      I know my serial connection is working. I am using a null modem converter with my FTDI usb/serial adapter. When I use the maintenance menu on the machine I get a various “Received SL_Service: 1” and other messages. When I load material the console says “read eeprom: 0, sending eeprom data, read eeprom: 1, sending eeprom data.” I also get a bunch of other messages when I move the head, move the drive motors, etc. But when I try er 0 0 512 or er 1 0 512 I do not get anything.

      I have an arduino but I do not fully understand how to read the eeproms with it. I think you have to put the arduino in tristate mode and connect the TX and RX pins to the eeprom. Do I just use the contacts on the eeprom pcb? Do the same terminal commands work? Could someone shed some light on this for me since I haven’t been able to find information on this?

      • Ben says:

        Tried PuTTY again which is working nicely. Now when I send er 0 0 512 the machine responds:

        Received ER_SERVICE: 0
        read eeprom: 0
        sending eeprom data

        but I don’t get the hexadecimal output. Is this something to do with Stratasys trying to prevent people from doing this hack?

        • Dan says:

          Odd, try using “er 0 0 256” – even something like “er 0 0 2”. The last integer in the string simply specifies what portion of the EEPROM to print out, so try a few variations.

          • Ben says:

            I got a bus pirate. I believe I got the information off of my eeproms. All of my eeproms are from Bolson Materials and appear to have different data than what is on the OEM ones. They look like they only have about 100 bits of data on them since all bits after those come back as 0 or 255. I am going to try refilling one of the eeproms soon. Hopefully it will work.

            I also found this tool, but have not tried it yet myself or if it would work with my machine. I’m not sure what the difference is between the two links.


            I think I saw my machine’s “gender” or codename when I was using MaracaEX. I mention that because it’s needed for the above tool and for some other things.

            • Ben says:

              This is the data I pulled off of one of my eeproms, I’m not sure if it’s correct or not…. This is one of the Bolson eeproms

              I’m stuck again, as I can’t seem to write all of the values back to the eeprom.

              • Ben says:

                I took all of the hex flags out of that eeprom data and ran it through your CSV tool. I just tried to write it through the Diag port using ew 0 0 {CSV data} (without brackets) and ew 0 0 0. After rebooting the machine the model material still reads 8% when it should read 69%. So I am completely convinced that my machine does not allow reading or writing of the eeprom. The help command does not work with my machine either.

                I just have to figure out how to properly write all of the data using the Bus Pirate and then hopefully the log file thing worked as well.

  8. Troy says:

    I have a Dimension Elite and I cannot get the serial port to connect with putty. I originally tried a USB to serial connector, but after seeing a comment about those cables possibly not working properly I shifted to another laptop with a built in serial port.

    Putty just gives me a blank screen, does the Dimension Elite have different settings? I have been trying random settings with no luck.

    • Dan says:


      Are you using a null modem cable?

      • Troy says:

        Thanks Dan, I made a null modem cable and it works – kind of. After trying to enter the commands and just getting the usual blank screen, I started getting characters back each time I pressed a key. So if I hold down enter I get the eeprom dump character by character displayed on the screen.

        Any ideas on why this doesn’t just auto-update? It could be problematic when going to write the eeprom data back.

      • Troy says:

        All good now with a null modem cable, a read command worked properly.

  9. schill says:

    Our Dimension Elite is throwing a code 18 fault. I was wondering if anybody has the service manual to look up the code. If you can post a link to it that would be great! Hoping to be able to replace our own material but then the machine went down :(

  10. Fábio says:

    Dan can you help me please?
    It’s the first time I do this procedure.
    I bought a ide disk and kept the original.
    I formatted the new drive and I ran the image into it. #! UYkHBD7Q! BubTv2So2eqO-fLH94iJKlw5q9g5rj-87uK6d5JyneE
    I used an external box in order to connect to the computer.
    When I installed this drive in SST768 I started the machine, the machine gave the following message: “Send upgrade from workstation”.
    I do not know for sure what the correct procedure to follow with this imaging system.
    If Dan can help me I’ll be thankful.
    I apologize for my English!

  11. Gil says:

    Hi I had just used your instructions and all went well till i tryed to read from EEPROM, i got request for 4 parameters and after that error that says only 128 bytes to read, finaly i entered “er 1 0 0 128” and got that:
    Support carrier ID (8 8-bit values)
    000000: b3 c8 de 03 d0 14 10 dd ……..

    Support carrier in bay 0: 128 bytes at address 0 (128 8-bit values)
    000000: 05 3e e7 86 79 16 d9 bd 4b ad 8a 72 af 98 10 2f .>..y…K..r…/
    000016: 27 97 c5 5a aa dc 7d 44 d1 21 92 6f 1e 2d f9 24 ‘..Z..}D.!.o.-.$
    000032: f3 1b 78 e1 51 a2 d6 b4 54 c8 9f ac 22 58 c1 11 ..x.Q…T…”X..
    000048: 54 c8 9f ac 22 58 c1 11 3b 73 2e 45 61 e6 ec 32 T…”X..;s.Ea..2
    000064: ea 7c 00 00 00 00 cc e9 55 aa 55 89 29 79 5d be .|……U.U.)y].
    000080: 7f b6 00 00 00 00 00 00 90 09 c2 84 00 e6 c6 c2 …………….
    000096: 43 56 d2 55 01 00 00 00 53 54 52 41 54 41 53 59 CV.U….STRATASY
    000112: 53 e1 70 82 e9 9d ed fc 14 23 31 4c ec 58 6c 39 S.p……#1L.Xl9

    is it ok ?

    • Dan says:

      Hi Gil,

      That should be fine, your cartridge may just have an abridged amount of data stored on the EEPROM.
      Are you working with the cartridges meant for the SST768 – or some other printer/cartridge combination?

    • Ben says:


      I cannot get my BST to dump the eeproms using the serial port either. It clearly recognizes the command but I am getting the same result you did. Could you please give me the arduino sketch and any relevant instructions as to dumping the eeproms and rewriting them? I am having a very difficult time getting my arduino to even get the eeprom addresses. Thanks!

  12. Fábio says:

    I have image the file onto the drive and install it in the SST768.
    When the machine starts i get “Send upgrade from workstation”
    I’m doing something wrong?
    Someone can help me please?
    Thank you!

  13. Tristan says:

    Hi! This is a great post. I am looking to get into the world of 3D printing, and I was wondering if this cartridge hack would work with the most recent Stratasys Dimensions 1200es printer, as I was unable to find any of the older 768’s available anywhere. Thanks in advance, Tristan.

  14. Brandon says:

    Okay I have once again figured it out! I feel dumb for not looking under the “serial” selection. Hopefully once I get a serial adapter it should work! Thank you for all this information Dan!!

    • Dan says:


      Be careful with the serial adapter – try to get one with FTDI (not all USB to serial devices are alike/you get what you pay for!)

      • Brandon says:

        Yeah I have a USB to serial adapter but I have been too afraid to mess with it so I think I will wait to turn it on until I get a male to female serial adapter

  15. Brandon says:

    Okay I have figured out how to save the file, but now I am having issues with PuTTY. I don’t see the entries to establish baud rate, data bits, flow control, etc.. Thanks in advance!

  16. Brandon says:

    Hello, I have added the following lines:
    rm -f /system.dat
    rm -f /mariner/config/system.dat

    But I can’t figure out how to save them. Any help is appreciated! Thanks

  17. Kent says:

    Just a follow up to my earlier questions
    When I paste the dump into the formatting tool and then press the submit button it pops up a window with the formatted data, but it won’t let me select the data in order to copy and paste it.
    I tried it in Internet explorer and Chrome it doesn’t let me select any of the content. Firefox is the only one that will let me select the data on the pop-up window.

    Am I doing something wrong?



  18. Kent says:

    Hi Dan,
    I have some follow up questions for you :-)

    I was never able to get a chip read directly from the printer, so I purchased a Arduino UNO board and was able to get a chip read via HyperTerminal , however it looks like it is missing some lines when comparing it to your sample readouts.

    For example is starts right in with line:
    000000 86 4C 8C 06 6A BD 22 DE 33 66 68 E7 75 2D CC CA .L..j.”.3fh.u-..

    So in other words it’s missing these first lines that show in your example:
    Model cartridge ID (8 8-bit values)
    000000: 23 f8 64 cd 00 00 00 d1 #.d…..
    Model cartridge: 512 bytes at address 0 (512 8-bit values)

    When I use the Arduino Uno Board via HyperTerminal it will let you either capture the dump to a text file, or you can copy and paste the info also.

    When I write the chip back to the chip I am getting the following results:

    Writing back the dump via a text file exactly as it was read:
    RESULTS: Appears to be not writing back the contents correctly, because the info on the chip does not match the original dump.
    Chip won’t work in the printer

    Writing back the dump via a text file after adding the top few lines added from your example ( Model cartridge ID (8 8-bit values) lines.
    RESULTS: Chip won’t work in the printer

    Taking the dump from the chip and pasting it into the formatting tool that you have on that webpage, and then pasting the formatted text into a text file and then writing it to the chip.
    RESULTS: It won’t write to the chip. It is indicating an error on one of the lines ( I believe it was line 29 )

    So I’m back at a stand still on the project.

    Today I did take the hard drive from the printer and manually deleted the system.dat file and it still didn’t allow any of the chips to work that I used the Arduino board on.

    I don’t have any brand new cartridges on hand, so in other words I have been trying to read chips that have 20% to 40% left. So do you think that may be my problem? ( Not using a 100% full chip for the original dump )

    Second Question:
    When I use your online tool for formatting the dump I am using the following technique:
    1. Paste my chip dump into the tool frame on the web page
    2. Press the submit button
    3. This opens up a separate window with the formatted content
    4. I copy the contents into my clipboard
    5. I paste the contents into Note Pad text editor
    6. Save the file to a text file
    7. Write this text file to the eeprom chip via hypercomm

    Am I doing this correctly?
    I don’t know if I am dreaming, but at one time I thought when you pressed on the submit button it would prompt you to save the file to your hard drive. ( Am I mistaken? )

    One last question:
    When I went to key in the following command in LXTerminal
    “sudo mkdir /media/sdb1″
    it appears the media directory was already there ( does the sound correct? )

    Thanks Dan,


    • Dan says:

      Hi Kent,

      You’ve almost got it!! Just a few things:

      For example is starts right in with line:
      000000 86 4C 8C 06 6A BD 22 DE 33 66 68 E7 75 2D CC CA .L..j.”.3fh.u-..

      So in other words it’s missing these first lines that show in your example:
      Model cartridge ID (8 8-bit values)
      000000: 23 f8 64 cd 00 00 00 d1 #.d…..
      Model cartridge: 512 bytes at address 0 (512 8-bit values)

      1. That’s perfect – the lines above 000000: get stripped out anyway! Just format the data you read out like so: 86,4c,8c,06,6a,bd,22,de,33,66,68,e7,75,2d,cc,ca,etc. – stripping out the left (count) and right (ASCII) columns. Example: becomes
      My EEPROM dump formatting tool certainly needs a lot of work/is very finicky!

      Today I did take the hard drive from the printer and manually deleted the system.dat file and it still didn’t allow any of the chips to work that I used the Arduino board on.

      1.5. See above; I think it was not working because the data written back was not correctly formatted.

      I don’t have any brand new cartridges on hand, so in other words I have been trying to read chips that have 20% to 40% left. So do you think that may be my problem? ( Not using a 100% full chip for the original dump )

      2. That’s fine – you can write back any percentage/data you wish to the same cartridge.

      When I went to key in the following command in LXTerminal
      “sudo mkdir /media/sdb1″
      it appears the media directory was already there ( does the sound correct? )

      3. Hmm perhaps it auto-mounted the printer’s HDD to that location, not a problem/nothing to be concerned about.

      Let us know how it goes – you’ve almost done it!

  19. Joep says:

    Hi Dan,

    We use the dimension SST 1200es, it is also equipped with the DIAG port.
    We having some problems with the serial connection to the printer, we’ve played with the baud settings and hardware controll, with no result. Putty shows a blank terminal screen, we cannot issue controlls. We make use of a usb to serial connector. How can we make a connection, are were missing somthing.

    Thanks in advanced


    • Dan says:

      Hi Joep,

      The problem may actually be the USB to Serial connector – those can be very finicky for things like this. If possible, try to use a direct serial/COM connection with the following settings:

      Baud rate: 38400
      8 data bits
      No parity
      1 stop bits
      Hardware flow control

      Let us know how it goes!

  20. Kent says:

    Just an update…..
    I loaded an older firmware version ( 5.4 build 1710 ) into the machine and tried the er 0 0 512 again and it didn’t make any change to the results.
    I tried letting the PUTTY run for a couple hours and it just continued to add “……” to the screen.

    After I keyed in the “er 0 0 512” command the following is what shows on the screen: ( is this what it should show? )

    Received ER_SERVICE: 0
    read eeprom: 0
    sending eeprom data

    Question for you:
    If you try the “er 0 0 512” on a system that has not had any changes made to the hard drive will it still give you an eeprom dump?

    The reason I ask is I’m trying to eliminate the possibility that I didn’t make the changes to the hard drive correctly.

    In other words is the changes we made to the hard drive what is allowing us to do the dump…. or are the changes just so it deletes the list of serial numbers from the chips?



    • Dan says:

      Hi Kent,

      The console is independent from the OS – the change on the HDD should not affect it at all (should be able to dump the EEPROM running completely stock firmware).

      I’ve actually prepared what I hope is a SST 768 universal image (I’ve tried it on two SST 768 printers and it worked very well). Simply fire up dd, win32diskimager, or some sort of imaging software, and image this onto the drive – make sure you have a good backup of the existing data, however! A word of warning – the .img.gz extracts to 30+GB.!UYkHBD7Q!BubTv2So2eqO-fLH94iJKlw5q9g5rj-87uK6d5JyneE

      Lastly, you may be running a different controller board (or, more likely, a newer version of the same Coldfire board) that has a slightly different set of commands/command syntax. Luckily, there is another way around this – manually dumping the cartridge’s EEPROM by using an Arduino or Bus Pirate (another commenter did it via the Arduino as detailed by them).


Leave a Reply

Your email address will not be published.