Stratasys EEPROM hack revisted

Five years ago, I published what is probably the single most popular post on this blog – namely, how to reset a Stratasys material cartridge EEPROM so that it can be refilled with much cheaper third party filament.  Dan at gnurds.com took things a step further and came up with some great step-by-step tutorials on how to accomplish this, and even had a post featured in hackaday.  I received a lot of questions and feedback on the hack (and even helped hack a few machines running in the field), but the fact that the process requires modifying contents on the printer’s hard drive put it out of reach for users who were barred from doing any sort of ‘invasive surgery’ on the machine (generally students stymied by school officials).  What was needed was a truly ‘touchless’ hack that didn’t require any modification of the base machine itself – we needed a way to actually generate our own EEPROM data from scratch rather than simply re-using the EEPROM data as it had come on the cartridge from the factory.  The problem is that the EEPROM data is encrypted.  Worse, my understanding of how DES crypto is done on a practical level is pretty much zero – I’ve done embedded programming before, but this sort of stuff is far outside my area of expertise.

Fortunately, in 2013 a wizard cracked the EEPROM crypto and posted the code to github!  Benjamin’s sorcery is just what’s needed to build your own EEPROM image, and he’s put a great deal of time and effort into it for zero financial gain.  As a result, it really bugs me when I see people using his code to sell programmers for hundreds of dollars, with zero attribution for his work.  This post, then, shows start-to-finish how you can refill your own P-class Stratasys cartridge using only a Raspberry Pi.  It’s admittedly long and detailed, but I think it’s important to understand the whole process before trying to use any shortcuts.

The reason that it’s taken me so long to document this hack is that I previously had no real access to a P-class machine.  Fortunately, my friends at Into3D LLC have one in their shop and were more than willing to let me attempt refilling one of their empty cartridges.  It’s a Dimension BST 768, which fortunately is still supported for 2 more years.  This is what the front panel looks like with a near empty (1% material remaining) model cartridge:

Here’s that very cartridge – the label on top lists some applicable patents (6776602, 7063285, 7341214, D436111, and 7754807):

The side has a recycling information label and identifying information for the cartridge itself – we’ll see how that matches up with the information on the EEPROM itself.

Use a 7/32″ hex wrench to remove the 4 screws on the underside of the cartridge (I used a fold-up set to break them free first, then a standard L-wrench to remove them).

Then, flip the cartridge over and give the shell a few raps with your knuckles to shift the internal desiccant packs into the bottom half.  Carefully lift off the top half of the cartridge, exposing the 1% of material remaining on the spool:

Despite my dislike of using cartridges for 3D printers (it’s a lot of excess material to house the consumable), these are actually quite well designed – there’s a pair of very simple drive wheels at the corner exit, and the other 3 corners get desiccant packs.  The orange-brown circumferential seal has a spot for the filament to exit through, and the screws actually thread into brass inserts, not into the raw plastic.  A single cartridge can be reused many times, potentially lasting a fair portion of the life of the actual machine.  Parked right next to the drive wheels in a slot is the object of our interest, the EEPROM board itself:

Here’s what the front and back of the EEPROM PCB looks like:

In case anyone is wondering, the text on the chip itself is:

DS2433
1226B1
586AC

As noted in the original blog post, the chip is a DS2433 (originally a Dallas Semiconductor product, hence the ‘DS’, now owned by Maxim).  Importantly, it is a 1-wire device, hence requiring only 2 contacts to the chip.  As an aside, this nomenclature has always annoyed me – power and signal may be carried over a single wire, but you still need a ground connection.

Now, to extract those pesky bits from the EEPROM, all 4096 of them!  Technically, there’s a few more bits that we’ll need as well – a 48-bit serial number, 8 bits for CRC, and an 8-bit family code (0x23).  I’ve used a Bus Pirate before, and you can use an Arduino as well, but for this post I’ll be showing how to use a Raspberry Pi, since we can do everything on a single, standardized platform.  In this case, I’m using a Raspberry Pi model B with an Adafruit breakout board, and I started with a clean NOOBS image (v1.7.0 to be specific) on a freshly formatted SD card.

I booted the RasPi and was greeted with the installer – since I had the RasPi connected to my network, it provided me with network installation options, but I selected only the first option to install the Raspbian OS:

While that was installing, I prepped the breakout board.

I connected the black alligator clip to a GND (0vdc) terminal and the red alligator clip to IO4 on the breakout board (which is pin 7 of the RasPi header).  Note that pinouts on the RasPi can be very confusing – IO4 on the breakout board is not GPIO.4 on the RasPi as I had first thought, but pin 4 of the Broadcom BCM2835 processor at the heart of of the RasPi (also known as GPIO.7 on the RasPi).  You can read more about this confusion at wiringpi.com.  I connected a 2.2k resistor to a 5vdc terminal and the IO4 terminal – this acts as a pullup.

By this time, Raspbian had finished installing and I was looking at a fresh new desktop.  I find it easier to just SSH into the RasPi, so once I determined its IP address (just hover your mouse over the network icon in the upper right of the desktop), I could fire up PuTTY and connect right to a shell (you can certainly do everything via a terminal window on the desktop, though).

On a default install of Raspbian, the login is pi and the password is raspberry.  While Raspbian includes just about all the software we’ll need by default, the Python crypto library will be required later on, so run sudo apt-get install python-crypto right away to install that package (the RasPi will need to be network connected with internet access for this to work).  I then attached the breakout board to the RasPi and proceeded to do some testing with gpio to make sure that my wiring was correct.

I hooked up an oscilloscope to the red and black leads (you can use a multimeter, but a scope will let us see when EEPROM reads are occurring, which is handy when debugging), and saw that I had nearly 5vdc, which is just what I was expecting due to the 2.2k pullup resistor.

Now, let’s have a look at actually controlling the pin that the red alligator clip is connected to.  The gpio readall command gives us a snapshot of what the status is of all the header pins (again, see wiringpi.com for details).  By default, all the I/O pins are set to be inputs (note pin 7 is set as ‘IN’):

We can change the mode from input to output on that pin with gpio mode 7 out

And as soon as that command is issued, the voltage drops to zero:

Issuing gpio write 7 1 will bring that pin high:

Resulting in 3.3v output (RasPi digital I/O is 3.3v, not 5v):

That’s all for verifying that the wiring is correct.  There’s one final change to make before we can actually try reading in an EEPROM, and that’s disabling Device Tree (I understand it’s possible to get things working with DT enabled by means of some other configuration changes, but disabling it altogether is the route I went with).  Run sudo raspi-config to bring up the configuration menu, and select Advanced Options:

Then, select Device Tree:

Select ‘No’:

And DT will then be set as disabled:

Back at the main menu, select Finish and you’ll be prompted to reboot (select ‘Yes’):

With the RasPi rebooted, we’re finally ready to read in an EEPROM.  Recite the magic incantations sudo modprobe w1-gpio gpiopin=4 and sudo modprobe w1-ds2433 (note that you’ll need to run those commands again if you reboot the RasPi, so it may be worthwhile to add them to a startup script):

Now, connect the clips to the EEPROM – black clip to the ground pad, red clip to the data pad (you can tell which is the ground pad because it has a trace on all 4 sides connecting it to the ground plane):

If you have a scope hooked up, you’ll see that the voltage drops to 3.3 volts and then there will be a data read every 10 seconds or so:

We can cd /sys/bus/w1/devices/w1_busmaster1 to have a look at the connected 1-wire devices seen by the RasPi, and therein is a specific directory created for that EEPROM (23-0000014d4762 in this case – your EEPROM will be different!):

You can also use the xxd command to hex dump the EEPROM’s full UID as shown (0x2362474d0100006b).  This particular UID consists of the family code (0x23, which should be the same on all Stratasys P-class EEPROMs, except for those used on uPrint cartridges), the device serial number (0x62474d010000 – note the endianness) and finally the checksum (0x6b).  The screenshot also shows a dump of the 512 bytes of EEPROM data itself.  In order to actually do anything with this EEPROM data, though, we’ll need Benjamin’s code.

We’ll cd back to our user directory and then grab a .zip archive of the code via wget https://github.com/bvanheu/stratasys/archive/master.zip, after which we can extract it into a directory via unzip master.zip.

We’ll cd into that directory and try running the main program by executing ./stratasys-cli.py -h

This is just what we want to see!  If instead you get a number of errors mentioning crypto, make sure that you have the python-crypto library installed.  At this point, we don’t need to do any further configuration on the RasPi, and we can actually dive into the EEPROM data itself.  If you’ve managed to get this far, you’re probably capable of basic command line Linux work, so I’m going to gloss over those details from this point onward and let screenshots do most of the talking.  First, we’ll copy the EEPROM data out to a file that we can actually work with.

A directory listing confirmed that the resulting file is exactly 512 bytes in length, and all the formatting looks just like all the other Stratasys EEPROM dumps I’ve seen.  Let’s take one more look at the EEPROM UID, as we’ll need to format it correctly to feed into the stratasys-cli program:

We need to reverse the byte order of the shown UID, so instead of 23 62 47 4d 01 00 00 6b we’ll use 6b 00 00 01 4d 47 62 23 (remember, the family code of 0x23 is at one end, and the checksum is at the other end).  Here we finally feed the EEPROM UID and the EEPROM data through the program, using ‘prodigy’ as the machine type (any Dimension series machine should be ‘prodigy’, but a different machine type (Titan, Maxum, etc.) will have a different family name):

If you don’t have the UID formatted properly, the program will fail with a checksum error:

If we take a quick look at the data, everything agrees with the label that was on the cartridge – the color, serial number, manufacturing lot, and manufacturing date all match perfectly (I’m guessing that the timestamp on the EEPROM data is actually GMT).  Note that while the last use date is a separate entry in the EEPROM data, I’ve never seen it differ from the manufacturing date (maybe Stratasys intended to write this data back to the cartridge, but couldn’t be certain that the printer itself would actually have the correct day/time set).  A service manual I saw indicated that this timestamp was intended to be the date/time that the cartridge was actually first inserted into a machine, so perhaps Stratasys intended to have cartridges ‘expire’ after a certain amount of time.

The EEPROM stores material quantity in terms of cubic inches.  A brand new cartridge contains 56.3 cubic inches worth of filament, and the current level as shown on the EEPROM is under 0.75 cubic inches, so the 1% filament remaining message on the printer’s front panel was right on (there was actually a little more than that remaining on the reel, but the overage allows for nozzle purges, waste due to swapping cartridges, etc.).  The original hack worked by simply setting the current material quantity back to 56.3, but the printer would remember the serial number of the cartridge (and refuse to work with that cartridge serial again), so files needed to be deleted on the printer itself.  Since we can now create our own EEPROM images from scratch, we can simply change the serial number in addition to the material quantity, and the printer will be none the wiser.

In addition to decrypting the EEPROM data and displaying it in a human readable format, Benjamin’s program can provide all the parameters needed to generate that very EEPROM data, which is extremely handy.  We’ll simply tack on the -r option to the command we just used:

We only need to change the highlighted options to create our desired EEPROM image:

Reading the generated neweeprom.bin file back through the program shows that the serial number is now different (I incremented the value by 1000 rather than 1 just in case there were consecutively serialized cartridges the machine had already seen), and the material quantity is back to ‘full’.  Now, we can finally write that file back to the EEPROM itself (remember to use sudo when writing to the EEPROM due to permissions):

A quick hexdump directly from the EEPROM verifies that we’ve modified the contents successfully.  Note that the new image we generated is only 113 bytes, while the original EEPROM data is a full 512 bytes.  This is because everything after the ‘STRATASYS’ at 0x69 is random garbage (early on, Stratasys simply padded out 0x71 onwards with zeros), so that portion of the EEPROM can be left unchanged.  That’s all that we need to do with the RasPi – the EEPROM can be disconnected and set aside.  All that remains is to reload the cartridge with fresh material.

My favorite current filament is the ‘High Performance ABS’ from Coex3D – I’m partial to them because they’re local, their product quality is excellent, and Chris gave an amazing presentation on polymer processing and filament extrusion to our 3D printing user group a few years ago.  He listened to my pleas for MG94 filament and thankfully started producing it.

While Coex3D reels fit right into my FDM series machines, they don’t fit into P-class cartridges (the bore is just a little too small, and there is a rubber piece attached to the top shell of the cartridge that would interfere anyhow).  So I needed to respool the new filament onto the old reel.

In fact, respooling the filament itself is probably the hardest part of the entire process!  I admittedly got a bit hackish with the use of electrical tape as a makeshift drive dog, but it worked.

Make sure that you have the desiccant packets in place, the EEPROM PCB in its slot, and the drive wheels in position, then very carefully feed the end of the filament through the hole in the disc portion of the gasket.  Hold the filament in its guide slot, and carefully place the top shell half back in place (this is pretty tricky without having the gasket jump out of place).  Flip it over, assemble the cartridge with the 4 screws, and our work is complete.  Now, for the moment of truth…

After loading the refilled cartridge into the printer, it showed a 100% full model spool!

Of course, the proof is in the prints, and the machine is now happily churning out parts far more inexpensively than before (and with better material properties than the OEM P400 filament had).

Notes:

1) Benjamin’s code works for other Stratasys printer families as well, including the big T-class and Maxum/Quantum machines.  It will even decrypt and generate binary images for uPrint cartridge EEPROMs.  However, uPrint cartridges use a different EEPROM model that unfortunately utilizes an HMAC authentication scheme for writes.  So while you can read EEPROMs and generate new .bin files, actually writing them back to the EEPROM is impossible without knowledge of the secret key used for the HMAC authentication.  If you only have access to a uPrint, you’re kind of stuck. [12FEB2017 addendum]  It turns out that an HMAC protected EEPROM can be re-written by using the DIAG port on the printer.  ‘Odin’ discovered this workaround and authored these concise instructions for the hack.  This isn’t quite ‘touchless’, but until someone breaks or sidesteps the HMAC protection, it’s the best option.

2) 56.3 cubic inches isn’t actually the maximum material quantity you can set on the EEPROM.  It’s a floating point number, so the sky is the limit!  However, on a P-class machine, 60.0 cubic inches is the maximum that the printer will accept as valid, as anything larger will instead be considered zero. [22FEB2017 addendum] Reports indicate that larger volumes can be used, but the ‘initial material quantity’ field needs to be similarly large.  However, others (Odin, for one) find that this doesn’t work on their machine, so this could be a difference between firmware revisions.

3) I mentioned using an Arduino to read/write the EEPROM.  There’s actually a fork of Benjamin’s code available on github called CartridgeWriter that runs in Windows and interfaces with an Arduino for EEPROM reads/writes.  I haven’t tried it myself, but others have used it successfully.  I prefer running Benjamin’s code directly on a RasPi due to the amount of control it provides.  Specifically, it makes some automation possible, such as…

4) …this clever little EEPROM rewriter made by Sneaks Hacks.  He’s posted the wiring schematic and STL files for the housing, and is currently working on an updated version as well as documentation for people wanting to build their own.

5) The Stratasys EEPROM PCB has a surface mount 4.7k pulldown resistor right next to the DS2433.  While most wiring schematics for reading/writing a Stratasys EEPROM show to use a 4.7k pullup between 5v and the data pad, I used a 2.2k to help ensure that voltage to the DS2433 remains in an acceptable range.  You can certainly start with a 4.7k pullup and reduce the resistance if you’re having flaky results, but I don’t think I’d go below 2.2k.

6) Benjamin notes that use of the –output-file option when generating EEPROM images isn’t actually correct in a traditional Unix sense, and that I/O redirection is really the proper Unix way to get binary output from stratasys-cli.py (that is, using something like ./stratasys-cli.py –foo –bar > my_file.bin).  I think using –output-file is a little easier to see and understand what’s going on, but if you’re building an automated system like Sneaks Hacks did, using stdout can help streamline the processing chain.  For example, you could write directly to the EEPROM and save a backup of the image all in one go by using something like ./stratasys-cli.py –foo –bar | tee backup_image.bin /sys/bus/w1/devices/w1_bus_master1/23-0000014d4762/eeprom.

7) Everything in this post is simply the compilation and distillation of other people’s hard work – I simply wanted to bring it to a wider audience.  These are the folks who deserve all the credit:

  • Huge thanks goes to Mjolinor, who I believe was the first to pioneer using a RasPi as an all-in-one solution for rewriting Stratasys EEPROMs.
  • Thanks to the anonymous and unnamed people (you know who you are) who have assisted in developing and testing these techniques over the past few years and helped review this post before publishing.
  • Steve, Joe, and John at Into3D LLC for letting me use their Dimension BST 768 as the guinea pig for this project.
  • First, last, again, and finally, Benjamin Vanheuverzwijn.  This man is an absolute electronic wizard and none of this would have been possible without him.  Send him coffee.

85 thoughts on “Stratasys EEPROM hack revisted

  1. Which model printer are you working with? How did you create the new image file? Did you verify that it was written back to the EEPROM properly?

  2. Thank you for the answer. We realized that we were not modifying the serial number, so the printer was saying that.
    Last question: is it possible to do all of this automatically during the boot of the Raspberry Pi ?

  3. Very cool, do you think you could use the same process for newer catridges on more advanced machines? e.g. Stratasys F270? would be happy to send you a chip flagged 0% to try?

  4. Stratasys already is ahead of the game due to their use of SHA-1 protected EEPROMs in the uPrint series (which are furthermore supposedly designed to brick themselves when reduced to 0% material remaining in an effort to foil this sort of hack). It wouldn’t surprise me at all if the F-series machines have an entirely different EEPROM data structure, given how much of a break the machines are from the existing P- and T-class units. At any rate, I’d be interested in at least seeing the contents of any F-series chips… Drop me a line at haveblue@haveblue.org

  5. Hello Have Blue,
    Following your steps (except for using gpio 21 instead of 7, I made it up until where I should be seeing the eeprom on the terminal window.
    http://oi63.tinypic.com/seosip.jpg
    It doesnt seem to be reading the eeprom though I am getting a voltage reading of 4V across the across the circuit..
    I should mention that once I entered the setmode 21 out command, I saw no voltage drop. Again there was no voltage drop when I wrote a value of 1 to pin 21.
    Could you give help me please?

  6. I tried that now. No difference. I am also using the newer eeproms (the one Ham referred to). I did try it with one of the older ones as well.

  7. seems like I had some wiring issues. That’s all cleaned up and I see the same readings (3.3V). I still cannot probe the eeprom. The 1 wire mode is enabled as well.

  8. I don’t have any good ideas, other than maybe getting one of those 1-wire thermistor devices I recall from a RasPi howto in order to verify proper 1-wire operation first.

  9. These simple steps still work nearly two years later in 2017! Fantastic step by step directions. Thank you to everyone involved.

  10. Note: With RPI3 there is no need to disable the device tree. Simply enable 1-wire in raspi-config, reboot and off you go!

  11. I got it to read the eeprom finally.
    Though I got the same “permission denied” message that Jay had gotten. Not sure what to do now. The rest of the steps worked though the printer showed the cartridge as empty.

  12. I actually misinterpreted your code: where I was to enter xxd -p id, I also typed in the id in the line beneath that, not realizing that that was the output, not a continuation of the previous input.
    Jay told me to try the complete path “xxd -p /sys/bus/w1/devices/w1_bus_master1/23 -000001174f17/id” and that is when I realized I ducked up.

  13. Hi everyone!
    It seems that new stratasys printers use different cartriges wich use an other component ( not a Maxim DS2433 one-wire EEPROM anymore…) Is there someone who have information about that ?
    Thank you very much in advance ! =)

  14. I have 2 Stratasys 380MC and 1 450MC. The eeprom in the cartridges seems not like to a DS2433. As i tried i think it is possible to read the content of the eeprom but it seems like impossible to write.

  15. Correct – the DS2432 (or workalike) uses SHA-1 authentication for writes. Without knowledge of the secret key, it is impossible to re-write the EEPROM.

  16. Hello, first of all thank you for this kind of guide, resulted very useful even to improve my knowledge.

    I got a problem in the last part of the copy the neweeprom into the eeprom getting an input/output error while writing, the eeprom that I’m testing with is the DS24B33, dunno if the eeprom have a SHA-1 authentication

    Everything worked well, but the last copy part.

  17. I am trying this with a Next Thing Co. CHIP instead of an Arduino. It did require recompiling the kernel to get it to be able to talk to the ds2433 EEPROM.

    After this I was able to follow the relevant directions here fairly well.

    I got as far as reading the EEPROM and then as far as creating a new, altered encrypted image and dumping it into a file (the file was verified to be correct and changed).

    Then I got stuck because something (I don’t know what) is protecting the file from being written. When I try the cp command I get “cp: error writing ‘/sys/bus/w1/devices/w1_bus_master1/23-0000007b6aec/eeprom’: Invalid argument” and “cp: failed to extend ‘/sys/bus/w1/devices/w1_bus_master1/23-0000007b6aec/eeprom’: Invalid argument” (and yes, I used sudo). I have also tried the ‘cat’ command with redirection (as in “sudo cat something > something_else”) and the dd command (again, I did not forget sudo). The ‘cat’ command responds with “Permission denied” and dd gives no errors but doesn’t actually do anything (that is, looking at the eeprom contents I can see that they are unchanged).

    I see nothing odd with permissions. The target file (‘/sys/bus/w1/devices/w1_bus_master1/23-0000007b6aec/eeprom’) is set writable by root (which I would have thought should have prevented this sort of error).

  18. I wonder if it’s a hardware issue? Could it be that the 3.3V logic on the chip is sufficient to read the DS2433 but not suficient to write it?

    Looking at a data sheet (https://goo.gl/Jyk1vB ), the caption for figure 8 is as follows:

    5kΩ IS ADEQUATE FOR READING THE DS2433. TO WRITE TO A SINGLE DEVICE, A 2.2kΩ RESISTOR AND VPUP OF AT LEAST 4.0V IS SUFFICIENT. FOR WRITING MULTIPLE DS2433s SIMULTANEOUSLY OR OPERATION AT LOW VPUP, THE RPU SHOULD BE BYPASSED BY A LOW-IMPEDANCE PULLUP TO VPUP WHILE THE DEVICE COPIES THE SCRATCHPAD TO EEPROM. DEPENDING ON THE 1-Wire COMMUNICATION SPEED AND THE BUS LOAD CHARACTERISTICS, THE OPTIMAL PULLUP RESISTOR (RPU) VALUE WILL BE IN THE 1.5kΩ TO 5kΩ RANGE.

  19. So why can’t all of this be done, via SSH, from the Stratasys itself?

    Shouldn’t the unchanged Python scripts work unchanged in these machines?

    Even if the device names are different, it should still have something, somewhere that has “w1_busmaster1” in its name (or something very much like it) and something, somewhere that has “w1_busmaster2” in its name (or something very much like it).

    Then the EEPROM chips (one for the model and one for the support) should somehow show up in the respective device tree branches coming down from that (one at w1_busmaster1 or its equivalent and the other at w1_busmaster2 or its equivalent). And then the only trick is that you need to read from that or write to that (as the case may be). The Python scripts don’t even care about that since it just gets passed as a parameter.

    So, really, the only thing that the printer (in my case the one I have access to is a Dimension 768 BST) requires for this to work is to have Python 2.x installed (more difficult than it should be —because rpm is broken in the 768 BST— but ultimately not that difficult) and to have the Python crypto library installed (and to get the scripts, of course).

    Am I missing anything here?

  20. I connected a 2.2k resistor to a 5vdc terminal and the IO4 terminal – this acts as a pullup.

    Why exactly can we do this? I was assuming that these pins on the Pi would be 5V tolerant but what I am reading suggests otherwise. Why aren’t we zapping that pin with too much voltage when connecting it to a 5V rail?

  21. By the way, your link to Odin’s hack on Note 1 actually points to a private network address (192.168.0.0 – 192.168.255.255 block).

  22. I have a larger Stratasys Fortus 400/450/900 FDM canister P/N:355-02110 (ABS-M30) that I would like to figure out how to reset. Care to take a crack at it? if you do not have one I could ship one to you….

  23. Recently I tried to rewrite another eeprom and discovered that it wouldn’t read. I checked all the connections, went through all the steps again, I even got a new raspberry pi and still it wouldn’t work. In the w1_bus_master1 directory the eeprom id starting with 23 would not appear, only something like 00-xx00000000. The xx would change every now and again. The voltages that I read from my multimeter are the same as last time.
    I tried downgrading to NOOBS 1.7 which also did not make a difference.
    It’s so strange because I was able to pull this off once and now it’s failing me. I would really appreciate any tips for solving this problem.

  24. Anyone got a good replacement for the break away support material P400R? I understand it’s a high impact polystyrene (HIPS), but of course print temp, and quality can vary greatly. I’m currently using Coex LLC’s mg94 in liu of the ABS P400.

  25. i would very much be interested in any developments for a Uprint, at the moment its the most expensive paperweight i own. or is this thread dead?

Leave a Reply

Your email address will not be published. Required fields are marked *