Welcome to Our Community

Unlock hidden features. Sign Up for Free Today!

Tear down of Cubify cube 3 3D Printer + convert to RepRap

Discussion in '3D printers' started by Oderbang, Dec 6, 2015.

  1. Kiza

    Kiza Journeyman
    Builder

    Joined:
    Dec 1, 2016
    Messages:
    74
    Likes Received:
    3
    It can. PIC32 is MIPS, little endian, you also need to create proper memory segments. I have IDA files if you need them.
     
  2. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    133
    Likes Received:
    31
    Would be nice to get them. Thank you.
    I will look into them. Did you get your Pickit3 yet?
     
  3. Geezer70

    Geezer70 Journeyman
    Builder

    Joined:
    Sep 30, 2016
    Messages:
    45
    Likes Received:
    9
    @eychei, @Kiza
    When attaching the PICKit3 to the ICSP header, MCLR is low this causes the Cube to hard reset and not restart until it is removed
    I did disconnect all hardware and attempt to power the motherboard with PICKit3. However, it can only supply about 80ma. Noit enough to bring up the board. I'm going to attempt connecting via JTAG and muddle around.

    Parsing an .ar file so that only the Intel Hex remains can be Imported, I repete IMPORTED, into MPLAB IDE.
    Create a new project, setup with PIC32MX695F512L. File Import *.hex. Set active project to the current one.
    Set Debugger to MPLAB - SIM. View/CPU Registers, /SFR peripherals, /Memory. The Memory window has all the code disasembled
    Click Data View for data or Code View for Duh, Code. You can save either to a txt file by right clicking on the widow "output to file".
    If you run the Sim you'll get an error because it executes at the beginning of the boot loader which attempts to load the executable
    at 9D00_0200 which is side 0, upper memory and fails because it is non-existing address.
    This will NOT debug the software. But, it allows you to view the Code and Data for disassempled clues.
    In order to actually run code and set break points, etc. you have to have an image loaded on a PIC32 chip and interfaced with a PICKit3.
    You can choose to load it on the Cube or a dev board. Either way the Flash area of the device will be ERASED before loading
    the new Image. That's just the it works. That's the reason you can't dump the Flash from the Cube via a PICKit3 through the ICSP header. I think the Code Protect fuse is set. But I haven't looked into it.

    If anyone knows how to get around this, please let us know.
     
  4. Geezer70

    Geezer70 Journeyman
    Builder

    Joined:
    Sep 30, 2016
    Messages:
    45
    Likes Received:
    9
    @Kiza I would appreciate the IDA files also.

    Or, if it is ok with you eychei could share ;)
     
  5. Kiza

    Kiza Journeyman
    Builder

    Joined:
    Dec 1, 2016
    Messages:
    74
    Likes Received:
    3
  6. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    133
    Likes Received:
    31
    I think getting a chipkit would be easier then trying to emulate the code with qemu. But if you could get it working it would be awesome. We could run everything in the emulator and test the code before flashing.
    Maybe Geezer70 can help with the SPIs and ICs he can run the code on his development board already.
     
  7. Geezer70

    Geezer70 Journeyman
    Builder

    Joined:
    Sep 30, 2016
    Messages:
    45
    Likes Received:
    9
    When you get the *.hex file loaded in MPLAB look at the C3_peripherals, all of the register assignments by address are listed.
    Are you familiar with how the PIC32 does I/O on its Ports? It is not at all like an Arduino or other dedicated I/O chips.
    I have 3DS firmware running on the WF32. However, because I have no HID to control it, it just sits fat dumb and happy waiting
    for a command.
    I haven't been hacking the SW lately, more into coding and decoding the G-Codes, which works quit well.
    Glad you guys are poking me. I needed inspiration to get back into whacking the SW. Especially with IDA.
    L8R G70
     
  8. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    133
    Likes Received:
    31
    The main problem with the g-codes are that you can't control the filament cartridge. The steps of the extruder are counted.
    So g code is only helpfully for using simplify3d or other slicing software. The only problem i see with cubeprint is the support generation which can be done with another software like meshmixer. It will generate support as a second file and you can change the extruder for the support structure in cubeprint.

    Is it possible to connect the cartridge to your chip kit?
    I think we could hack the original software to write the cartridges like we want. How about changing the step counts to be negative for the extruder ?
     
  9. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    133
    Likes Received:
    31
    Can someone plug in a USB Cable on the side of the Cube 3 and try to get into bootloader mode.
    There is a software in the Cube Print installation directory called HIDBOOTLOADER.EXE.

    If we can connect through that, firmware backup and flashing will be easier.
     
  10. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    133
    Likes Received:
    31
    Another thing I did find out is that Port 30304 is open and used for file transfer. Protocol is BEEP.
    Just connect it with putty or other terminal program on Port 30304.
    Send the following command:
    {"header":{"msg_type":1,"msg_method":1,"version":1},"payload":{}}

    You can vary with the code and get other messages back, like extruder Temp and Cartridge status etc.

    I am using MobaXterm. To send the command copy paste the command from here hit Enter Key on your keyboard a "^M" command will show up, then press CTRL+ENTER to send the command. ^M is carriage return.
     
  11. bolsoncerrado

    bolsoncerrado Veteran
    Builder

    Joined:
    Nov 8, 2016
    Messages:
    220
    Likes Received:
    4
    Thanls for sharing all hacking guys! Would u mind crossposting these to Cube3 too? We have some tech savy people there too perhaps we can join forces ;)

    Also the wiki is set up and running in case you wanna share your findings re the mobo and such ;)

    i plan to dissassemble a brand new unit and take hi res pics of it too, just for the rest of people inclined to hack it evenn more.

    Any of you running 3rd part y filament care to share pics of their cart setups? :)

    Any of you foiund out if the LCD is propietary or open market?
     
  12. Geezer70

    Geezer70 Journeyman
    Builder

    Joined:
    Sep 30, 2016
    Messages:
    45
    Likes Received:
    9
    Connected w/Putty Raw port 30304
    i get:
    {"header":{"msg_type":3,"msg_method":0,"version":1},"payload":{"error_code":101,"error_category":1,"error_msg":"Invalid header"}}

    ^@ refreshes the above

    I never used BEEP before interesting.....

    See what I mean? Gimme, GIMME, GIMME...Lol
     
  13. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    133
    Likes Received:
    31
    Try this first

    {"header":{"msg_type":1,"msg_method":16,"version":1},"payload":{}}
     
  14. Geezer70

    Geezer70 Journeyman
    Builder

    Joined:
    Sep 30, 2016
    Messages:
    45
    Likes Received:
    9
    eychei asked:"Is it possible to connect the cartridge to your chip kit?

    I haven't tried a direct connection to the Dallas Chip in the Cartridge. However, it uses SHA256 so without the response key I would only get garbage.
    Different conversation:
    I tried length ".01" in the header and trailer of the G-Code and seemed to not de-increment filament used. I'll try with larger print, if I can get thru
    it without a cartridge jam...POS
     
  15. Geezer70

    Geezer70 Journeyman
    Builder

    Joined:
    Sep 30, 2016
    Messages:
    45
    Likes Received:
    9
    @eychei
    Didn't work I'll try X-Term session next.
    BTW, GREAT FIND, DUDE!!!!!
     
  16. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    133
    Likes Received:
    31
    Actually i tried simplify3d with that option too.

    It seemed to me that the cartridge amount wasn't changing. But didn't try a longer print yet.
    What i meant with connecting the cartridge was that when you use the original firmware it should also write to the chip without us knowing the key.

    This is also used in software keygens. Just change the code that it splits out what you want.
     
  17. Geezer70

    Geezer70 Journeyman
    Builder

    Joined:
    Sep 30, 2016
    Messages:
    45
    Likes Received:
    9
    @eychei
    I've tried getting into the Boot loader using the same method as used on the Cube 2. I'd have to Google it again
    but it was something like hold the power key down while pluging in the USB, then release the power key.
    Anyway didn't work.
    I'm going to try your find on the chipKit next.
    Are we having fun yet?
     
  18. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    133
    Likes Received:
    31
    Actually i am having fun with this.
    But I do have work and other stuff going and my time will be very limited soon. I know everyone has the same thing going but we need to push forward. I did ask the stratahackers group for assistance. Maybe we have to mobilise our connections and friends more.
     
  19. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    133
    Likes Received:
    31
    What you could try on the chip kit is the telnet port. This would be much easier:) if it works your firmware works:)
     
  20. Geezer70

    Geezer70 Journeyman
    Builder

    Joined:
    Sep 30, 2016
    Messages:
    45
    Likes Received:
    9
    "What i meant with connecting the cartridge was that when you use the original firmware it should also write to the chip without us knowing the key."
    I understand what you meant. But, from what I've read about the key exchange the Chip is master and the printer is slave,
    Printer to chip here's my key
    chip to printer here's the key for encryption
    Printer to chip here's my new key
    Chip to Printer Ok we'll talk
    Printer to chip here's my encrypted data.
    I does this for every exchange of read, write or verify
    Don't hold me to the above it's been a couple of months since I was into it. I think I'll try a port monitor using an Adruino as a logic probe.
    I'm going quiet for awhile lots of things to try. Thanks for the good info and pokes. Email me to ring my bell.....
     
  21. bolsoncerrado

    bolsoncerrado Veteran
    Builder

    Joined:
    Nov 8, 2016
    Messages:
    220
    Likes Received:
    4
    neat stuff going on! keep it up! ;)
     
  22. Kiza

    Kiza Journeyman
    Builder

    Joined:
    Dec 1, 2016
    Messages:
    74
    Likes Received:
    3
    Oh, I see you are having fun! That's great! :) By the way, who can tell me, where are cartridge chip readers connected?, Also, what is connected to I2C bus and SPI 1 bus? Would be great for me to know.
     
  23. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    133
    Likes Received:
    31
    @Geezer70 can you help Kiza out. I cant help him.
     
  24. Geezer70

    Geezer70 Journeyman
    Builder

    Joined:
    Sep 30, 2016
    Messages:
    45
    Likes Received:
    9
    When you get to be my age, this IS better than sex, literally...

    I know the I2Cs are used to communicate with the cartridge chips. Just don't know without a schematic.
    The I2Cs would have to be connected to a Dallas Chip like a DS2465. The chip on the cart is a DS28E15.

    Hope this helps.

    L8R, Over and Out....
     
  25. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    133
    Likes Received:
    31
    Hello,

    can someone please verify which chip is on the cartridge. Is it a DS28E01-100 or is it an DS28E15.
    The original posted of this thread statet that is a DS28E01.

    Please can someone verify, maybe also take a picture of the chip.

    Thx
     
  26. Tom Dirriwachter

    Builder

    Joined:
    Aug 30, 2016
    Messages:
    247
    Likes Received:
    20
    The original post is correct. DS28E01 is the chip on the cartridge.
     
  27. Tom Dirriwachter

    Builder

    Joined:
    Aug 30, 2016
    Messages:
    247
    Likes Received:
    20
    Glad I started reading that tech sheet on the chip.
    There may be a hole in the system worth noting below.
    If we can get the bias voltage up high enough, it can't write.
    What do you suppose the system will do in this case?

    upload_2017-1-1_11-47-4.png
     
  28. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    133
    Likes Received:
    31
    Hmmm. could be something. What does the datasheet say about Vpup and Vtl?
    There was a hack on the older cartridges, if i remember correctly, they used a diode to block the chip from writing.
     
  29. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    133
    Likes Received:
    31
    how about putting in a zener diode like this?

    diode.JPG
     
  30. Tom Dirriwachter

    Builder

    Joined:
    Aug 30, 2016
    Messages:
    247
    Likes Received:
    20
    I'm going at this similarly... but the Cube 3 is unique as a lot of Cube X and cube 2 hacks did not transfer.

    They are using something that pulls down the signal. If you make sure it never pulls below RPUP-V during a write command, it shouldn't be able to write.
    However, it does need to do a handshake. The second part of the equation is still to have the system forget what cartridges it saw.
     

Share This Page

  • About Us

    The OpenBuilds Team is dedicated helping you to Dream it - Build it - Share it! Collaborate on our forums and be sure to visit the Part Store for all your Building needs!
  • Like us on Facebook

  • Support Open Source FairShare Program!

    OpenBuilds FairShare Give Back Program provide resources to Open Source projects, developers and schools around the world. Invest in your future by helping others develop theirs!

    Donate to FairShare!