Welcome to Our Community

Some features disabled for guests. Register Today.

Tear down of Cubify cube 3 3D Printer + convert to RepRap

Discussion in '3D printers' started by Oderbang, Dec 6, 2015.

  1. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    144
    Likes Received:
    34
    Hmm. I dont really know what you mean.
    The VCD file can be looked at with pulseview for example.
    The leading number is the time and the Numbers labeled with A, B, C are the channels. In my file only channel A was used. Thats why the other channels are all 0s.
    I think you can measure the distance between the bits in pulseview. This would be your time.

    I think I got your question wrong...
     
  2. Tom Dirriwachter

    Builder

    Joined:
    Aug 30, 2016
    Messages:
    250
    Likes Received:
    21
    Cool. So it is a single sync pulse. That makes it easier. Somehow I thought it was 8 bytes of data.

    Yes, I am considering a simple microprocessor controlled "interrupt" to tap the line. once detected, we should be able to scramble the signal at the right time. Scrambling is the easy part.

    This is what I am thinking could be mapped back to a time domain... Milliseconds, microseconds, picoseconds?

    upload_2017-1-4_8-55-43.png
     
  3. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    144
    Likes Received:
    34
    Just install Pulseview and import the file as VCD. You will see the timeline and can also measure the time between 0s and 1s.
     
  4. Naldarn

    Naldarn Journeyman
    Builder

    Joined:
    Jun 7, 2014
    Messages:
    43
    Likes Received:
    0
    Here are the firmware from 1.07 to 1.14b, hope this helps with reverse engineering the firmware. I would also like to help with that, so if anyone has the IDA or MPLAB files needed to read and dissassemble the firmware, pm me!
     

    Attached Files:

  5. Naldarn

    Naldarn Journeyman
    Builder

    Joined:
    Jun 7, 2014
    Messages:
    43
    Likes Received:
    0
    Geezer70,

    I'm following your firmware dissection, I get different addresses in the .ar files, and am not sure how to slice the files out of the firmware. I would like to compare the firmware files and see where the filament handling code is.



     
  6. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    144
    Likes Received:
    34
    Open the file with HxD and find the section where the ASCII code is Image695.hex
    Delete everything that comes before and after the section with all the numbers.
    It starts with:
    :020000041D00DD
    Last line of firmware is :
    :00000001FF

    Save the file as hex. This is a Intel Hex file. You can load it into MPLAB and look into the memory.
     
  7. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    144
    Likes Received:
    34
    Something new i did find:

    On firmware 1.09A the telnet diagnostics server is up and running on port 23. You can connect to it with telnet client.
    User: 3d
    Password: print3d

    There is also Port 80 which is open and leads to the EasyConfig Demo Application of microchip.

    On firmware above 1.11A the code was modified:
    • Diagnostic code removed to provide better prints.
     
    Kiza likes this.
  8. bolsoncerrado

    bolsoncerrado Veteran
    Builder

    Joined:
    Nov 8, 2016
    Messages:
    226
    Likes Received:
    5
    "...to provide better prints" rotfflol
     
  9. Naldarn

    Naldarn Journeyman
    Builder

    Joined:
    Jun 7, 2014
    Messages:
    43
    Likes Received:
    0
    Ok, got quite a few bits of info in the keywords file I uploaded. If any of it looks familiar to others, it may help with firmware edits. Also found what looks like web pages or server pages. Some references to Adobe ImageReady. And what looks like ascii art in the shape of letters if you look at the ascii half in a hex editor.

    All of this is out of the 1.07A firmware, before all the extra "improvements"
     

    Attached Files:

  10. Naldarn

    Naldarn Journeyman
    Builder

    Joined:
    Jun 7, 2014
    Messages:
    43
    Likes Received:
    0
    Also found the following ports open:

    Port 23 (TCP) Telnet
    Port 25 (TCP) Simple Mail Transfer Protocol
    Port 80 (TCP) Microchip EasyConfig Demo
    Port 110 (TCP) Post Office Protocol, version 3 (POP3)
    Port 119 (TCP) Network News Transfer Protocol
    Port 143 (TCP) Internet Message Access Protocol (IMAP)
    Port 465 (TCP) URL Rendezvous Directory for SSM (Cisco protocol) or Authenticated SMTP over TLS/SSL (SMTPS)
    Port 563 (TCP) NNTP over TLS/SSL (NNTPS)
    Port 587 (TCP) email message submission[80] (SMTP)
    Port 993 (TCP) Internet Message Access Protocol over TLS/SSL (IMAPS)
    Port 995 (TCP) Post Office Protocol 3 over TLS/SSL (POP3S)
    Port 30303 (UDP) from the microchip documentation: listen and respond to discovery requests sent to UDP port 30303 starting with the character 'D'.
    Port 30304 (TCP) from the microchip documentation: reset if R is received
    Port 30305 (TCP) personal observation: port was opened when sending a file from the PC to the printer, maybe saving to the microsd before print? Possible way of loading firmware over ethernet?
     
    #370 Naldarn, Jan 4, 2017
    Last edited: Jan 6, 2017
  11. Naldarn

    Naldarn Journeyman
    Builder

    Joined:
    Jun 7, 2014
    Messages:
    43
    Likes Received:
    0
    And one last post for tonight, could not login to telned with the 3d and print3d credentials, but did find them in the 1.14b firmware.
     
  12. Tom Dirriwachter

    Builder

    Joined:
    Aug 30, 2016
    Messages:
    250
    Likes Received:
    21
    Which port is acting like a clock/chip-sync-pulse?
    That should be linked to the "one-wire" port communicating with the chip.
    This should be a very pervasive routine as it appears to be always active except while printing, although presence is sensed, probably on the pull-up resistor (open collector?).
     
  13. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    144
    Likes Received:
    34
    @Naldarn

    Which firmware are you on? On Firmware 1.09A the credentials are working.
     
  14. Naldarn

    Naldarn Journeyman
    Builder

    Joined:
    Jun 7, 2014
    Messages:
    43
    Likes Received:
    0
    I am on 1.14b to my horror.
     
  15. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    144
    Likes Received:
    34
    You can downgrade. Use two USB sticks.
    Put 1.14b on one stick and the desired on the other stick but rename the older firmware file to 1.14b.

    Start the update process from USB and get the stick off the printer when it says downloading. Then put in the stick with the older firmware.

    I did read this tutorial on another forum.
     
  16. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    144
    Likes Received:
    34
    Sorry. Could also be on this forum :)
     
  17. Naldarn

    Naldarn Journeyman
    Builder

    Joined:
    Jun 7, 2014
    Messages:
    43
    Likes Received:
    0
    I downgraded the firmware, and telnet worked with credentials, and did receive the debug info which included the "leveling info" for the build plate. Ever since I connected, there is no data over telnet once logged in.
     
  18. Kiza

    Kiza Journeyman
    Builder

    Joined:
    Dec 1, 2016
    Messages:
    75
    Likes Received:
    3
    Great find! I was trying the same credentials on 1.14B and it did not work. Strange, I thought credentials are not correct for the diag telnet. Thank you! Downgrading now ^_^
     
  19. Kiza

    Kiza Journeyman
    Builder

    Joined:
    Dec 1, 2016
    Messages:
    75
    Likes Received:
    3
    Ok, made it working :) Now my printer also goes into diag telnet, I wonder if there are any commands we can use :)
     
  20. Naldarn

    Naldarn Journeyman
    Builder

    Joined:
    Jun 7, 2014
    Messages:
    43
    Likes Received:
    0
    What exactly did you modify in the firmware to remove the user and pass?
     
  21. Kiza

    Kiza Journeyman
    Builder

    Joined:
    Dec 1, 2016
    Messages:
    75
    Likes Received:
    3
    Nothing, read the post above, I just downgraded to version 1.09B and telnet works there.
     
  22. Naldarn

    Naldarn Journeyman
    Builder

    Joined:
    Jun 7, 2014
    Messages:
    43
    Likes Received:
    0
    Thanks Kiza, was hoping you had been able to edit the firmware!

    Pardon my ADHD, happened to luck into the XML file listing all the files in the amazonaws for cubify.
     

    Attached Files:

  23. Tom Dirriwachter

    Builder

    Joined:
    Aug 30, 2016
    Messages:
    250
    Likes Received:
    21
    Thank you for parsing the XML file, Naldarn!
     
  24. Kiza

    Kiza Journeyman
    Builder

    Joined:
    Dec 1, 2016
    Messages:
    75
    Likes Received:
    3
    Editing firmware is not a problem once we know what to edit. Problem will be putting the modified .hex back to .ar file, that's where we will have to find where is the ckecksum(s) stored.
     
  25. Tom Dirriwachter

    Builder

    Joined:
    Aug 30, 2016
    Messages:
    250
    Likes Received:
    21
    This is what seems to be managing version compatibility:
    magellan_software.xml
    upload_2017-1-6_16-20-2.png
     
  26. Naldarn

    Naldarn Journeyman
    Builder

    Joined:
    Jun 7, 2014
    Messages:
    43
    Likes Received:
    0
    Yep, I downgraded my cube print software, blocked its internet access and was able to send the printer a file without getting the dreaded "minimal value not met"

    Also found this mentioned elsewhere looks like a good mod for those using the chip switch:
    3D Systems Cube 3 cartridge modification by Cube_3
     
    #386 Naldarn, Jan 6, 2017
    Last edited: Jan 6, 2017
  27. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    144
    Likes Received:
    34
    is this xml file on the sdcard?
     
  28. Tom Dirriwachter

    Builder

    Joined:
    Aug 30, 2016
    Messages:
    250
    Likes Received:
    21
    I would suspect so, I doubt this would be reliable enough to rely on the internet to confirm.
    We still don't have the installed content of the internal SD uploaded anywhere.
     
  29. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    144
    Likes Received:
    34
    Okey I did check the SD Card of my CubePro and there is no such xml file.
    I did upload the SD Card Files.

    There is nothing to see in there:(


    edit:
    I cant upload the file as attachment. Did try to change the extension to txt but still no luck.
     
  30. eychei

    eychei Veteran
    Builder

    Joined:
    Dec 26, 2016
    Messages:
    144
    Likes Received:
    34
    Yes it is a zip file. I tried uploading as zip.
     

Share This Page