Stratasys Fortus 450mc

[Toblivar]

Has anyone had any luck reading/writing the 450mc chips? I've noticed they are slightly different in how they store everything (UID is 23-xxxxxxxx, no eeprom file but a "rw" file, "rw" file shows as all f values when viewed with xxd). I also understand that they use SHA-1 encryption on these.

If anyone can help point me in the right direction, I would appreciate any help available.

Thanks!

[fsabbatini89]

Helo Toblivar, did you manage to solve this?

[Mickele84]

News?

[cj1294]

I'm also in a similar situation with the 250mc

[Mickele84]

🙏🏼😅

Thanks.

Saluti

Michele Rossetti

Inviato da iPhone

Il giorno 16 apr 2018, alle ore 21:57, cj1294 notifications@github.com ha scritto:

I'm also in a similar situation with the 250mc

— You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

[tjschweizer]

So I've been poking at this for a few days now and I can't seem to make any headway. I've got a few dozen of the chips for the fortus 450 filament, so if anyone needs more scans let me know.

Attached is an excel file containing two hex dumps from one filament canister. Here is the data I get about the filament from the printer itself:

Name: "ASA_RED" Color Label "Red" Color Code "A6192E" Family Name "ASA" Family Display Name "ASA" MFG Date: "02052018" - Feb 5th 2018 MFG Lot: "104582" Initial Matl - "92.31" (cu.in.) Serial Number "414253482"

So I got the hex dump from the canister, then unloaded some filament and got the hex dump again. Here's the amount:

Before unloading filament, Remaining Material = "3.95126" (cu.in) After unloading filament, Remaining Material = "3.45126" (cu.in)

Looking at the hex dump, the only difference is in the first 12 bytes of data. It goes from: B6C0C36D4C996BE81E69C2A - before, to 9308DBDD63796E351DABC06 - after

I'm not even trying to write to this EEPROM, I'm just trying to read the remaining material from the canister without putting the canister in the printer...

Anyways, if anyone can crack this code that would be great, because I am at wit's end.

414253482.xlsx

[tjschweizer]

fsabbatini89,

Do you have any pictures of how you accessed the canister controller board?Or did you just use the diagnostic port on the back of the printer?

[tjschweizer]

Yikes, that's an expensive warranty to void!

Have you tried sniffing the lines while the printer is checking the canister itself? I'll try getting a log of that tomorrow, and maybe see if I can get to that control board.

When you say erasing the serial number of the cartridge from the PC resets the material, does that mean the material count isn't actually stored on the EEPROM? That's.... disheartening.

Either way, keep me updated and I'll post some data when I get it! Enjoy the beer haha

[tjschweizer]

Oh that's clever!

If/when you get a chance, can you post a trace of the full write command? Or just a full serial log between the pc and canister board?

[tjschweizer]

Awesome!

I'm not even trying to get this EEPROM info to write to it - I just want to be able to read it. I have maybe 20 canisters that I have to log the remaining material in, and I want to just do it with a microcontroller without having to load the canister into the printer.

Seeing the write message before it is encrypted will go a long way towards figuring it out. Plus if you share that string, then I don't have to break my printer getting to the serial traces :stuck_out_tongue_winking_eye:

[tjschweizer]

So I'm getting some more data today. Here is a EEPROM dump, an oscilloscope sniff of the printer reading the EEPROM, and the information of the canister pulled from a TCP stream for full canister of yellow ASA.

EEPROM Dump - yellow full.txt ASA Yellow Full TCP.txt

Oscilloscope trace

[tjschweizer]

Here's the same set of files but after running through a load-unload cycle (uses roughly 0.5 cu.in. of material)

EEPROM Dump - Yellow Load_Unload1.log ASA Yellow Load_Unload1 TCP Stream.txt

Oscilloscope Trace

[tjschweizer]

And after another load-unload cycle

EEPROM Dump - Yellow Load_Unload2.log ASA Yellow Load_Unload2 TCP Stream.txt

Oscilloscope Trace

[tjschweizer]

Here's the OneWire Hex values of the Oscilloscope trace

I'm going through and checking for common commands and stuff

ASA Yellow Load_Unload1 - scope sniff.txt ASA Yellow Load_Unload2 - scope sniff.txt ASA Yellow Full - scope sniff.txt

[tjschweizer]

@fsabbatini89 Did you get a chance to get a log of the commands?

[tjschweizer]

So if I get access to the HDD, does anyone know what exactly I should be looking for?

[tjschweizer]

@fsabbatini89

Do you remember what the baud rate of the RS422 is?

[jerryjonesiwe]

Hello,

New to the forum here and want to help.

What value pull up resistor are you using?

[Mickele84]

2,2k

Saluti

Michele Rossetti

Inviato da iPhone

Il giorno 27 set 2018, alle ore 02:00, jerryjonesiwe notifications@github.com ha scritto:

Hello,

New to the forum here and want to help.

What value pull up resistor are you using?

— You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

[fsabbatini89]

Hello everyone, any updates on this matter?

[fsabbatini89]

@jerryjonesiwe @tjschweizer Did you make any progress decrypting the file?

[fsabbatini89]

@tjschweizer How did you manage to make the eeprom dump through the diag port? What command did you use?

[Spider83]

Hello. any news about this project? I have Vantage Se and Fortus 450mc. Now i`m using raspberry to reflash eeproms on Vantage SE chips. If I can help with testing or smth else - here i am )

[fsabbatini89]

I think I am almost there. I would need some dumps of filled cartridges of different materials if you have. Fortus 380 or 450

El El mar, 4 dic. 2018 a las 02:48, Spider83 notifications@github.com escribió:

Hello. any news about this project? I have Vantage Se and Fortus 450mc. Now i`m using raspberry to reflash eeproms on Vantage SE chips. If I can help with testing or smth else - here i am )

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/bvanheu/stratatools/issues/53#issuecomment-443979837, or mute the thread https://github.com/notifications/unsubscribe-auth/AY6NUqjK1gcQ6ynh9X7_XM5dGhDgrq-9ks5u1gzHgaJpZM4ORbNn .

-- Franco

[Spider83]

I think I am almost there. I would need some dumps of filled cartridges of different materials if you have. Fortus 380 or 450 El El mar, 4 dic. 2018 a las 02:48, Spider83 notifications@github.com escribió: Hello. any news about this project? I have Vantage Se and Fortus 450mc. Now i`m using raspberry to reflash eeproms on Vantage SE chips. If I can help with testing or smth else - here i am ) — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#53 (comment)>, or mute the thread https://github.com/notifications/unsubscribe-auth/AY6NUqjK1gcQ6ynh9X7_XM5dGhDgrq-9ks5u1gzHgaJpZM4ORbNn . -- Franco

if you give me instructions how to make them - i`l send them to you. I have all kind of materials with support for 450mc except St130 and Antero.

[fsabbatini89]

With the chip reader you have, with the raspberry just read and out it in a file

El El mar, 4 dic. 2018 a las 07:30, Spider83 notifications@github.com escribió:

I think I am almost there. I would need some dumps of filled cartridges of different materials if you have. Fortus 380 or 450 El El mar, 4 dic. 2018 a las 02:48, Spider83 notifications@github.com escribió: Hello. any news about this project? I have Vantage Se and Fortus 450mc. Now i`m using raspberry to reflash eeproms on Vantage SE chips. If I can help with testing or smth else - here i am ) — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#53 (comment) https://github.com/bvanheu/stratatools/issues/53#issuecomment-443979837>, or mute the thread https://github.com/notifications/unsubscribe-auth/AY6NUqjK1gcQ6ynh9X7_XM5dGhDgrq-9ks5u1gzHgaJpZM4ORbNn . -- Franco

if you give me instructions how to make them - i`l send them to you. I have all kind of materials with support for 450mc except St130 and Antero.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/bvanheu/stratatools/issues/53#issuecomment-444051793, or mute the thread https://github.com/notifications/unsubscribe-auth/AY6NUr_FCmaAnGX-ej-vdVFeUZgINNcVks5u1k7VgaJpZM4ORbNn .

-- Franco

[Spider83]

ok. will try it tomorrow and then write back. Today have work to do.

[Mickele84]

Good job!!

Saluti

Michele Rossetti

Inviato da iPhone

Il giorno 4 dic 2018, alle ore 11:21, fsabbatini89 notifications@github.com ha scritto:

I think I am almost there. I would need some logs of filled cartridges of different materials if you have. Fortus 380 or 450

[fsabbatini89]

@Spider83 What kind of filament do you use for your vantage, brand and type?

[fsabbatini89]

Check this out Stratasys hack

[tjschweizer]

I don't get it - this doesn't do anything to modify the EEPROM, right? It just erases the temporary value stored on the hard drive before the printer writes that value to the EEPROM?

[fsabbatini89]

It does not allow the value to get to the eeprom

El El dom, 9 dic. 2018 a las 14:25, tjschweizer notifications@github.com escribió:

I don't get it - this doesn't do anything to modify the EEPROM, right? It just erases the temporary value stored on the hard drive before the printer writes that value to the EEPROM?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/bvanheu/stratatools/issues/53#issuecomment-445555469, or mute the thread https://github.com/notifications/unsubscribe-auth/AY6NUj9sZbOlXOBgVZhDMKifmKbyN33bks5u3Ud2gaJpZM4ORbNn .

-- Franco

[tjschweizer]

Ahh. In that case, I think a simple "sudo service masterd restart" would probably work instead of a full reboot.

Is this your video? Has anyone been able to enable ssh on the 380/450?

Also sorry for not responding to the earlier messages - work got insane and is finally dying down. I am still working on decrypting the EEPROM, but who knows.

I never got my EEPROM dumps from the diag port on the 450 - I got them using an arduino.

[fsabbatini89]

Anyway if you decrypt the eeprom you will not be able to write it as long as you Don’t have the secret

In the video you can see how after printing just unplug and plug the cartridge gives full amount again

El El dom, 9 dic. 2018 a las 15:08, tjschweizer notifications@github.com escribió:

Ahh. In that case, I think a simple "sudo service masterd restart" would probably work instead of a full reboot.

Is this your video? Has anyone been able to enable ssh on the 380/450?

Also sorry for not responding to the earlier messages - work got insane and is finally dying down. I am still working on decrypting the EEPROM, but who knows.

I never got my EEPROM dumps from the diag port on the 450 - I got them using an arduino.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/bvanheu/stratatools/issues/53#issuecomment-445558620, or mute the thread https://github.com/notifications/unsubscribe-auth/AY6NUk4C1GYk3utdlDdynL3Z-CdYgn-tks5u3VGegaJpZM4ORbNn .

-- Franco

[Puddle-Jumper]

Hi, Iam new here. Whats the status? You are able to read and decrypt the eeprom. But you cant write because we havnt the sha secret?

[Puddle-Jumper]

I start makeing some EEPROM dumps. If anyone is interested please ask. But I dont want to share them here publicly.

[Leitnin]

Check this out Stratasys hack

Can you provide some more details about this?

[jerryjonesiwe]

Has anyone here on the thread managed to reprogram the plus canister EEPROM. I’ve been on this thread for a while but lost touch.

Sent from my iPhone Jon Thomas

On Apr 3, 2019, at 7:45 PM, Dan Leitner notifications@github.com wrote:

Check this out Stratasys hack

Can you provide some more details about this?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[fsabbatini89]

@Leitnin Yes, Put a new cannister, use it use it and use it. When it is empty just remove the cannister and fill it up. Reboot the machine and voila, the cartridge is full again. It works as a charm. You have to use a man in the middle pcb in between the cartridge and sbc

[Leitnin]

@fsabbatini89

Thank you for the speedy reply. I appreciate it. I'm sure though, you can imagine that while that sounds great and like exactly what I and others are looking for, it really isn't sufficient information for someone to understand what needs to be done or what they need to acquire to make this work.

1. Details on the is the man in the middle pcb?
2. What about the files that need to be deleted if over 30cm^3?

[fsabbatini89]

I created a file that gets executed at startup that deletes a file that holds the amount of a wire in a used catdrige I can upload a picture tomorrow of the pcb I made

El El mié, 3 abr. 2019 a las 22:00, Dan Leitner notifications@github.com escribió:

@fsabbatini89 https://github.com/fsabbatini89

Thank you for the speedy reply. I appreciate it. I'm sure though, you can imagine that while that sounds great and like exactly what I and others are looking for, it really isn't sufficient information for someone to understand what needs to be done or what they need to acquire to make this work.

1. Details on the is the man in the middle pcb?
2. What about the files that need to be deleted if over 30cm^3?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/bvanheu/stratatools/issues/53#issuecomment-479710587, or mute the thread https://github.com/notifications/unsubscribe-auth/AY6NUiO6xdh54bw-6Q1EoYNtOr4iWu93ks5vdU7FgaJpZM4ORbNn .

-- Franco

[jerryjonesiwe]

Awesome. My goal is to be able to take an EEPROM and set to 92. Also if it’s possible to reprogram into another material that’s great.

I know what it can be done because I have a friend at Stratasys and he says the box is no bigger than a cigarette pack and they reuse all the time.

Just need to get around encryption.

Sent from my iPhone Jay

On Apr 3, 2019, at 9:34 PM, fsabbatini89 notifications@github.com wrote:

I created a file that gets executed at startup that deletes a file that holds the amount of a wire in a used catdrige I can upload a picture tomorrow of the pcb I made

El El mié, 3 abr. 2019 a las 22:00, Dan Leitner notifications@github.com escribió:

@fsabbatini89 https://github.com/fsabbatini89

Thank you for the speedy reply. I appreciate it. I'm sure though, you can imagine that while that sounds great and like exactly what I and others are looking for, it really isn't sufficient information for someone to understand what needs to be done or what they need to acquire to make this work.

1. Details on the is the man in the middle pcb?
2. What about the files that need to be deleted if over 30cm^3?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/bvanheu/stratatools/issues/53#issuecomment-479710587, or mute the thread https://github.com/notifications/unsubscribe-auth/AY6NUiO6xdh54bw-6Q1EoYNtOr4iWu93ks5vdU7FgaJpZM4ORbNn .

-- Franco — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[7786]

I created a file that gets executed at startup that deletes a file that holds the amount of a wire in a used catdrige I can upload a picture tomorrow of the pcb I made El El mié, 3 abr. 2019 a las 22:00, Dan Leitner notifications@github.com escribió: @fsabbatini89 https://github.com/fsabbatini89 Thank you for the speedy reply. I appreciate it. I'm sure though, you can imagine that while that sounds great and like exactly what I and others are looking for, it really isn't sufficient information for someone to understand what needs to be done or what they need to acquire to make this work. 1. Details on the is the man in the middle pcb? 2. What about the files that need to be deleted if over 30cm^3? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#53 (comment)>, or mute the thread https://github.com/notifications/unsubscribe-auth/AY6NUiO6xdh54bw-6Q1EoYNtOr4iWu93ks5vdU7FgaJpZM4ORbNn . -- Franco

We're also very interested in more information about this PCB if you're willing to share, we'd love to do this to our work printer.

[fsabbatini89]

Hi! I am moving my machine to a new location. As soon as i plug it again i will show you how it works

On Fri, Apr 12, 2019 at 12:28 AM 7786 notifications@github.com wrote:

I created a file that gets executed at startup that deletes a file that holds the amount of a wire in a used catdrige I can upload a picture tomorrow of the pcb I made El El mié, 3 abr. 2019 a las 22:00, Dan Leitner notifications@github.com escribió: @fsabbatini89 https://github.com/fsabbatini89 https://github.com/fsabbatini89 Thank you for the speedy reply. I appreciate it. I'm sure though, you can imagine that while that sounds great and like exactly what I and others are looking for, it really isn't sufficient information for someone to understand what needs to be done or what they need to acquire to make this work. 1. Details on the is the man in the middle pcb? 2. What about the files that need to be deleted if over 30cm^3? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#53 (comment) https://github.com/bvanheu/stratatools/issues/53#issuecomment-479710587>, or mute the thread https://github.com/notifications/unsubscribe-auth/AY6NUiO6xdh54bw-6Q1EoYNtOr4iWu93ks5vdU7FgaJpZM4ORbNn . -- Franco

We're also very interested in more information about this PCB if you're willing to share, we'd love to do this to our work printer.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/bvanheu/stratatools/issues/53#issuecomment-482423399, or mute the thread https://github.com/notifications/unsubscribe-auth/AY6NUqLa9tk_3EAdv3yNdoP3yC0KeIT-ks5vf_1egaJpZM4ORbNn .

-- Franco

[fsabbatini89]

Ok, Man in the middle technique. In the attached pictures you can take a look how the system is connected. My custom PCB is located in the middle between the cartridge bay pcb and the mainboard. You can see in the pic below that each cartdrige bay has its own man in the middle pcb..

The only thing to solve is make a Cron job to delete the file so you can change the cartridge when it is empty without having to turn off and on the machine

[Mickele84]

😲😲👌🏾 good job.

Saluti

Michele Rossetti

Inviato da iPhone

Il giorno 19 apr 2019, alle ore 15:28, fsabbatini89 notifications@github.com ha scritto:

Ok, Man in the middle technique. In the attached pictures you can take a look how the system is connected. My custom PCB is located in the middle between the cartridge bay pcb and the mainboard. You can see in the pic below that each cartdrige bay has its own man in the middle pcb..

The only thing to solve is make a Cron job to delete the file so you can change the cartridge when it is empty without having to turn off and on the machine

— You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

[spencermclegg]

@fsabbatini89, I'd like to try your hack. Are you willing to provide the details (schematic, etc.)? anyone else been able to ssh into the 450 and work around the filament eeprom check?

[fsabbatini89]

Hi! I have been using my hack for a long time without any issues!

El El vie, 31 ene. 2020 a la(s) 14:54, spencermclegg < notifications@github.com> escribió:

@fsabbatini89 https://github.com/fsabbatini89, I'd like to try your hack. Are you willing to provide the details (schematic, etc.)? anyone else been able to ssh into the 450 and work around the filament eeprom check?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/bvanheu/stratatools/issues/53?email_source=notifications&email_token=AGHI2UUM3SIECK7OEQI3LITRARQU3A5CNFSM4DSFWNT2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEKPOTEA#issuecomment-580839824, or unsubscribe https://github.com/notifications/unsubscribe-auth/AGHI2UV46XD6TFBWSXOLJTDRARQU3ANCNFSM4DSFWNTQ .

-- Franco

[fsabbatini89]

I can provide the schematics and the hex so you can test it in your machine

El El vie, 31 ene. 2020 a la(s) 14:54, spencermclegg < notifications@github.com> escribió:

@fsabbatini89 https://github.com/fsabbatini89, I'd like to try your hack. Are you willing to provide the details (schematic, etc.)? anyone else been able to ssh into the 450 and work around the filament eeprom check?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/bvanheu/stratatools/issues/53?email_source=notifications&email_token=AGHI2UUM3SIECK7OEQI3LITRARQU3A5CNFSM4DSFWNT2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEKPOTEA#issuecomment-580839824, or unsubscribe https://github.com/notifications/unsubscribe-auth/AGHI2UV46XD6TFBWSXOLJTDRARQU3ANCNFSM4DSFWNTQ .

-- Franco

[spencermclegg]

@fsabbatini89, yes, send the schematics and source my way. spencermclegg [at] gmail

[Spider83]

I can provide the schematics and the hex so you can test it in your machine El El vie, 31 ene. 2020 a la(s) 14:54, spencermclegg < notifications@github.com> escribió: @fsabbatini89 https://github.com/fsabbatini89, I'd like to try your hack. Are you willing to provide the details (schematic, etc.)? anyone else been able to ssh into the 450 and work around the filament eeprom check? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#53?email_source=notifications&email_token=AGHI2UUM3SIECK7OEQI3LITRARQU3A5CNFSM4DSFWNT2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEKPOTEA#issuecomment-580839824>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AGHI2UV46XD6TFBWSXOLJTDRARQU3ANCNFSM4DSFWNTQ . -- Franco

can you send it to me too? kruchok [at] gmail