{"id":33,"date":"2017-09-13T22:24:04","date_gmt":"2017-09-13T22:24:04","guid":{"rendered":"http:\/\/www.haxtom.com\/?p=33"},"modified":"2017-09-14T07:50:15","modified_gmt":"2017-09-14T07:50:15","slug":"recube-story-of-cube3-hack-part-2","status":"publish","type":"post","link":"http:\/\/www.haxtom.com\/?p=33","title":{"rendered":"ReCube: Story of Cube3 hack part 2"},"content":{"rendered":"

Further hacking work went to step were I had to find how firmware uses cartridges memories. So I check possible text outputs and I have found:<\/p>\n

\"\"<\/a><\/p>\n

Especially this one: “UpdateCartridgeQntCheckPresent: eWriteCartridgeStatus=%i” was very promising. Actually all this logs was also visible via UART terminal.<\/p>\n

So when I went to function which called this log file, I was sure that one of the called functions there do a memory writing magic:<\/p>\n

\"\"<\/a><\/p>\n

To understand how reading and writing to secured memory is working I read carefully (few times \ud83d\ude42 ) documentation for DS1963S:<\/p>\n

 <\/p>\n

\"\"<\/a><\/p>\n

It was very hard but crucial to find all responsible functions used during writing of current quantity. Generally printer is using 2 banks of cartridge memory, both have 32 bytes length. Bank 0 consist information about material type, material color and max amount of cartridge. All of this information is additionally secured with special checksum. Bank 1 have only information about current quantity status.<\/p>\n

It took me around 1 month to find how to read cartridges memories, 1 week more to find how to write them and 2 month more to find how to calculate checksum. Finally I have constructed ReCube v1, special tool to “refill” Cube3 cartridges:<\/p>\n

\"\"<\/a> \"\"<\/a><\/p>\n

This small “stick” is based on Arduino Nano and is able to “refill” fully cartridge with just 1-click or much more via UART console. Some short movie showing enhanced possibilities of this device you can find here:<\/p>\n