Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stratasys Fortus 450mc #53

Open
Toblivar opened this issue Jul 7, 2017 · 81 comments
Open

Stratasys Fortus 450mc #53

Toblivar opened this issue Jul 7, 2017 · 81 comments

Comments

@Toblivar
Copy link

Toblivar commented Jul 7, 2017

Has anyone had any luck reading/writing the 450mc chips? I've noticed they are slightly different in how they store everything (UID is 23-xxxxxxxx, no eeprom file but a "rw" file, "rw" file shows as all f values when viewed with xxd). I also understand that they use SHA-1 encryption on these.

If anyone can help point me in the right direction, I would appreciate any help available.

Thanks!

@fsabbatini89
Copy link

Helo Toblivar, did you manage to solve this?

@Mickele84
Copy link

News?

@cj1294
Copy link

cj1294 commented Apr 16, 2018

I'm also in a similar situation with the 250mc

@Mickele84
Copy link

Mickele84 commented Apr 17, 2018 via email

@tjschweizer
Copy link

So I've been poking at this for a few days now and I can't seem to make any headway. I've got a few dozen of the chips for the fortus 450 filament, so if anyone needs more scans let me know.

Attached is an excel file containing two hex dumps from one filament canister. Here is the data I get about the filament from the printer itself:

Name: "ASA_RED"
Color Label "Red"
Color Code "A6192E"
Family Name "ASA"
Family Display Name "ASA"
MFG Date: "02052018" - Feb 5th 2018
MFG Lot: "104582"
Initial Matl - "92.31" (cu.in.)
Serial Number "414253482"

So I got the hex dump from the canister, then unloaded some filament and got the hex dump again.
Here's the amount:

Before unloading filament, Remaining Material = "3.95126" (cu.in)
After unloading filament, Remaining Material = "3.45126" (cu.in)

Looking at the hex dump, the only difference is in the first 12 bytes of data. It goes from:
B6C0C36D4C996BE81E69C2A - before, to
9308DBDD63796E351DABC06 - after

I'm not even trying to write to this EEPROM, I'm just trying to read the remaining material from the canister without putting the canister in the printer...

Anyways, if anyone can crack this code that would be great, because I am at wit's end.

414253482.xlsx

@tjschweizer
Copy link

fsabbatini89,

Do you have any pictures of how you accessed the canister controller board?Or did you just use the diagnostic port on the back of the printer?

@tjschweizer
Copy link

Yikes, that's an expensive warranty to void!

Have you tried sniffing the lines while the printer is checking the canister itself? I'll try getting a log of that tomorrow, and maybe see if I can get to that control board.

When you say erasing the serial number of the cartridge from the PC resets the material, does that mean the material count isn't actually stored on the EEPROM? That's.... disheartening.

Either way, keep me updated and I'll post some data when I get it! Enjoy the beer haha

@tjschweizer
Copy link

Oh that's clever!

If/when you get a chance, can you post a trace of the full write command? Or just a full serial log between the pc and canister board?

@tjschweizer
Copy link

Awesome!

I'm not even trying to get this EEPROM info to write to it - I just want to be able to read it. I have maybe 20 canisters that I have to log the remaining material in, and I want to just do it with a microcontroller without having to load the canister into the printer.

Seeing the write message before it is encrypted will go a long way towards figuring it out. Plus if you share that string, then I don't have to break my printer getting to the serial traces 😜

@tjschweizer
Copy link

tjschweizer commented Jun 10, 2018

So I'm getting some more data today. Here is a EEPROM dump, an oscilloscope sniff of the printer reading the EEPROM, and the information of the canister pulled from a TCP stream for full canister of yellow ASA.

EEPROM Dump - yellow full.txt
ASA Yellow Full TCP.txt

Oscilloscope trace

@tjschweizer
Copy link

tjschweizer commented Jun 10, 2018

Here's the same set of files but after running through a load-unload cycle (uses roughly 0.5 cu.in. of material)

EEPROM Dump - Yellow Load_Unload1.log
ASA Yellow Load_Unload1 TCP Stream.txt

Oscilloscope Trace

@tjschweizer
Copy link

@tjschweizer
Copy link

Here's the OneWire Hex values of the Oscilloscope trace

I'm going through and checking for common commands and stuff

ASA Yellow Load_Unload1 - scope sniff.txt
ASA Yellow Load_Unload2 - scope sniff.txt
ASA Yellow Full - scope sniff.txt

@tjschweizer
Copy link

@fsabbatini89 Did you get a chance to get a log of the commands?

@tjschweizer
Copy link

So if I get access to the HDD, does anyone know what exactly I should be looking for?

@tjschweizer
Copy link

@fsabbatini89

Do you remember what the baud rate of the RS422 is?

@jerryjonesiwe
Copy link

Hello,

New to the forum here and want to help.

What value pull up resistor are you using?

@Mickele84
Copy link

Mickele84 commented Sep 27, 2018 via email

@fsabbatini89
Copy link

Hello everyone, any updates on this matter?

@fsabbatini89
Copy link

@jerryjonesiwe @tjschweizer
Did you make any progress decrypting the file?

@fsabbatini89
Copy link

@tjschweizer
How did you manage to make the eeprom dump through the diag port? What command did you use?

@Spider83
Copy link

Spider83 commented Dec 4, 2018

Hello. any news about this project? I have Vantage Se and Fortus 450mc. Now i`m using raspberry to reflash eeproms on Vantage SE chips. If I can help with testing or smth else - here i am )

@fsabbatini89
Copy link

fsabbatini89 commented Dec 4, 2018 via email

@Spider83
Copy link

Spider83 commented Dec 4, 2018

I think I am almost there. I would need some dumps of filled cartridges of different materials if you have. Fortus 380 or 450 El El mar, 4 dic. 2018 a las 02:48, Spider83 [email protected] escribió:
Hello. any news about this project? I have Vantage Se and Fortus 450mc. Now i`m using raspberry to reflash eeproms on Vantage SE chips. If I can help with testing or smth else - here i am ) — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#53 (comment)>, or mute the thread https://github.com/notifications/unsubscribe-auth/AY6NUqjK1gcQ6ynh9X7_XM5dGhDgrq-9ks5u1gzHgaJpZM4ORbNn .
-- Franco

if you give me instructions how to make them - i`l send them to you. I have all kind of materials with support for 450mc except St130 and Antero.

@fsabbatini89
Copy link

fsabbatini89 commented Dec 4, 2018 via email

@Spider83
Copy link

Spider83 commented Dec 4, 2018

ok. will try it tomorrow and then write back. Today have work to do.

@Mickele84
Copy link

Mickele84 commented Dec 4, 2018 via email

@fsabbatini89
Copy link

@Spider83
What kind of filament do you use for your vantage, brand and type?

@fsabbatini89
Copy link

Check this out
Stratasys hack

@tjschweizer
Copy link

I don't get it - this doesn't do anything to modify the EEPROM, right? It just erases the temporary value stored on the hard drive before the printer writes that value to the EEPROM?

@Basement-Modder
Copy link

I can provide the schematics and the hex so you can test it in your machine El El vie, 31 ene. 2020 a la(s) 14:54, spencermclegg < [email protected]> escribió:
@fsabbatini89 https://github.com/fsabbatini89, I'd like to try your hack. Are you willing to provide the details (schematic, etc.)? anyone else been able to ssh into the 450 and work around the filament eeprom check? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#53?email_source=notifications&email_token=AGHI2UUM3SIECK7OEQI3LITRARQU3A5CNFSM4DSFWNT2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEKPOTEA#issuecomment-580839824>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AGHI2UV46XD6TFBWSXOLJTDRARQU3ANCNFSM4DSFWNTQ .
-- Franco

I would also appreciate an email. I have been toying with these new chips for a while and haven't really gotten anywhere. bill.the.williamson at gmail

@fsabbatini89
Copy link

fsabbatini89 commented Feb 6, 2020 via email

@fsabbatini89
Copy link

fsabbatini89 commented Feb 6, 2020 via email

@spencermclegg
Copy link

pickit 3/4, surface mount parts, and the rs4585 parts are not a problem. Looking forward to the schematic and source code.

@Puddle-Jumper
Copy link

Same here. Can you send it to me too? tempmail348 at abwesend de
Whats with the cronjob?

@fsabbatini89
Copy link

fsabbatini89 commented Feb 7, 2020 via email

@spencermclegg
Copy link

@fsabbatini89 still waiting for the schematic and source.

@fsabbatini89
Copy link

fsabbatini89 commented Feb 20, 2020 via email

@spencermclegg
Copy link

@fsabbatini89 where are we at on this? Can you send the schematic and source?

@fsabbatini89
Copy link

@spencermclegg I am so sorry, i completely forgot about this!
Here you can download the schematics, pcb and firmware! Any question let me know
https://wetransfer.com/downloads/69ce8aad4439fd509f9156960a3e248020200317234513/414ebc3b4e248b408e5ae35229c3a51e20200317234513/89a3c3

@spencermclegg
Copy link

@fsabbatini89 thank you! Do you have the source code for the firmware?

@fsabbatini89
Copy link

fsabbatini89 commented Mar 19, 2020 via email

@Spreekom
Copy link

Spreekom commented Apr 2, 2020

@fsabbatini89 Very interesting project. A slightly different approach than usual. By the way - what is the crystal resonator frequency you have used on your PCB?

@fsabbatini89
Copy link

@Spreekom I am sorry, i forgot to add it on the eagle schematics as i used one i had in my box of junk haha. Tomorrow i will take a look at what the resonator says.. in my MPLAB project i have written

#define SYS_FREQ 60825600LL
#define FCY SYS_FREQ/2

With configuration bits HS PLL
and

CLKDIVbits.PLLPRE = 0;
CLKDIVbits.PLLPOST = 0;
PLLFBDbits.PLLDIV = 20;

so, following the formula from the manual

FIN = Fosc / ((PLLDIV + 2) / ((PLLPRE + 2) * 2(PLLPOST + 1) )) = 60825600 / (22/4) = 11059200 = 11.0592MHz

If i remember well, this is optimal frequency for the baudrate 115200 needed in this application (timing error = 0)

Good luck!

@noothatch
Copy link

@fsabbatini89 I am interested in making this PCB but the file download is gone, any chance you could upload it again? If you are looking for help with this project I would be really interested in helping. I don't have that much experience but I will have access to a 380mc at my summer job and my boss will let me open it up.

@fsabbatini89
Copy link

fsabbatini89 commented Apr 17, 2020 via email

@ironbird0
Copy link

@fsabbatini89
I am interested in making this PCB but the file download is gone, any chance you could upload it again?

@fsabbatini89
Copy link

@ironbird0 @noothatch
Sorry for the delay, i forgot about this.
I uploaded to my gdrive. Here is the link
https://drive.google.com/drive/folders/1uO-HXUHaWsKCHPSIVgzpw0o5M40Jm-a0?usp=sharing

@VorobeyVadim
Copy link

@fsabbatini89
Hello Franco.
I am trying to do your hack but getting a few issues.
You posted a photo of your devices, but I can see additional wires are soldered on them around the rs485 driver chip. Are these changes already included with the last circuit and PCB or will I need to do them too?
131242

And also, you talked about a file that gets executed at startup that deletes a file that holds the amount of a wire in a used cartridge. Can you give more explanation? Can you, please, upload this file and how to use it?

@additive3d
Copy link

Hello everybody,

We would like to offer compatible material for Fortus series 3d printers in EU.
Filament is manufactured using the same raw resin grade and specifications as OEM filament.
No clogs, no jams, no moisture. We ensure you are receiving the best possible filament on the market.

Fortus Compatible Material Pricing for EU.pdf

@fsabbatini89
Copy link

Yes my friend,
in the schematics the changes are included. Those wires are there because i messed up with the A and B signals in the RS485 driver, i had it wrong so i had to invert the wires in both chips (that's why there are 4 cables)
Any issues let me know, glad to help but i can tell you that it works like a charm.. been using the machine without issues for several months now.

Regarding the file that needs to be deleted i will let you know because i have some notes over here but i need to look them up :P

Regards

@fsabbatini89
Hello Franco.
I am trying to do your hack but getting a few issues.
You posted a photo of your devices, but I can see additional wires are soldered on them around the rs485 driver chip. Are these changes already included with the last circuit and PCB or will I need to do them too?
131242

And also, you talked about a file that gets executed at startup that deletes a file that holds the amount of a wire in a used cartridge. Can you give more explanation? Can you, please, upload this file and how to use it?

@VorobeyVadim
Copy link

Hi.
Franko, did you had a chance to check your notes about the file that needs to be deleted? I`ve almost done with PCB and for resuming progress on this issue I would like to know how I can deal with this.
I'll be really appreciated any additional information! )

@fsabbatini89
Copy link

Hi.
Franko, did you had a chance to check your notes about the file that needs to be deleted? I`ve almost done with PCB and for resuming progress on this issue I would like to know how I can deal with this.
I'll be really appreciated any additional information! )

I am so sorry!
Did you get a chance to make this work?
I have been printing and printing and printing without any issues 🙃

@VorobeyVadim
Copy link

Hi.
Franko, did you had a chance to check your notes about the file that needs to be deleted? I`ve almost done with PCB and for resuming progress on this issue I would like to know how I can deal with this.
I'll be really appreciated any additional information! )

I am so sorry!
Did you get a chance to make this work?
I have been printing and printing and printing without any issues 🙃

Hi Franco.
I've done with the PCB, but i can't deal with the printer filesystem. Iike i see from your youtube video, i need to delete two files named /mariner/config/system.dat and /etc/var/lib/dbus/xdh-cache. But I run into issue how I can get access to the file system? Am I abble to get the SSH access or I need to phisicaly remone HDD from printer, connect it to my computer and copy there my own script to delete needed files? Maybe you can provide the script and some simple instruction how i can run that script.

@fsabbatini89
Copy link

fsabbatini89 commented Oct 28, 2020 via email

@JarekC-DIY
Copy link

@fsabbatini89
Can you share information about how works your hack or source code for PIC?

@fsabbatini89
Copy link

fsabbatini89 commented Feb 8, 2021 via email

@ejg3855
Copy link

ejg3855 commented Sep 28, 2022

@fsabbatini89 did you ever create a fork for this?

@infodin7
Copy link

infodin7 commented Jan 1, 2023

did you manage reseeting the eeprom of the ds2432? if yes can somone help with it?

@Zelenyi488
Copy link

Я решил выпустить все сейчас, поскольку использую хак в течение длительного времени без проблем. Я скоро опубликую это в своем GitHub El El jue, 4 февраля. 2021 а-ля 16:16, JarekC-СДЕЛАЙ САМ [email protected] escribió:
@fsabbatini89 https://github.com/fsabbatini89 Не могли бы вы поделиться информацией о том, как работает ваш хак или исходный код для PIC? — Вы получили это сообщение, потому что вас упомянули. Ответьте на это электронное письмо напрямую, просмотрите его на GitHub <#53 (комментарий)> или отпишитесь https://github.com/notifications/unsubscribe-auth/AGHI2UVDYJGASA6GMWBSHH3S5LW7NANCNFSM4DSFWNTQ .
-- Франко

Привет . подскажи пожалуйста успешно ли показал себя метод на форус 450 мс
если да то скинь пожалуйста ссылку на репозиторий . хочу попробовать с принтером на работе

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests