Stratasys EEPROM hack revisted

Five years ago, I published what is probably the single most popular post on this blog – namely, how to reset a Stratasys material cartridge EEPROM so that it can be refilled with much cheaper third party filament.  Dan at gnurds.com took things a step further and came up with some great step-by-step tutorials on […]

Five years ago, I published what is probably the single most popular post on this blog – namely, how to reset a Stratasys material cartridge EEPROM so that it can be refilled with much cheaper third party filament.  Dan at gnurds.com took things a step further and came up with some great step-by-step tutorials on how to accomplish this, and even had a post featured in hackaday.  I received a lot of questions and feedback on the hack (and even helped hack a few machines running in the field), but the fact that the process requires modifying contents on the printer’s hard drive put it out of reach for users who were barred from doing any sort of ‘invasive surgery’ on the machine (generally students stymied by school officials).  What was needed was a truly ‘touchless’ hack that didn’t require any modification of the base machine itself – we needed a way to actually generate our own EEPROM data from scratch rather than simply re-using the EEPROM data as it had come on the cartridge from the factory.  The problem is that the EEPROM data is encrypted.  Worse, my understanding of how DES crypto is done on a practical level is pretty much zero – I’ve done embedded programming before, but this sort of stuff is far outside my area of expertise.

Fortunately, in 2013 a wizard cracked the EEPROM crypto and posted the code to github!  Benjamin’s sorcery is just what’s needed to build your own EEPROM image, and he’s put a great deal of time and effort into it for zero financial gain.  As a result, it really bugs me when I see people using his code to sell programmers for hundreds of dollars, with zero attribution for his work.  This post, then, shows start-to-finish how you can refill your own P-class Stratasys cartridge using only a Raspberry Pi.  It’s admittedly long and detailed, but I think it’s important to understand the whole process before trying to use any shortcuts.

The reason that it’s taken me so long to document this hack is that I previously had no real access to a P-class machine.  Fortunately, my friends at Into3D LLC have one in their shop and were more than willing to let me attempt refilling one of their empty cartridges.  It’s a Dimension BST 768, which fortunately is still supported for 2 more years.  This is what the front panel looks like with a near empty (1% material remaining) model cartridge:

Here’s that very cartridge – the label on top lists some applicable patents (6776602, 7063285, 7341214, D436111, and 7754807):

The side has a recycling information label and identifying information for the cartridge itself – we’ll see how that matches up with the information on the EEPROM itself.

Use a 7/32″ hex wrench to remove the 4 screws on the underside of the cartridge (I used a fold-up set to break them free first, then a standard L-wrench to remove them).

Then, flip the cartridge over and give the shell a few raps with your knuckles to shift the internal desiccant packs into the bottom half.  Carefully lift off the top half of the cartridge, exposing the 1% of material remaining on the spool:

Despite my dislike of using cartridges for 3D printers (it’s a lot of excess material to house the consumable), these are actually quite well designed – there’s a pair of very simple drive wheels at the corner exit, and the other 3 corners get desiccant packs.  The orange-brown circumferential seal has a spot for the filament to exit through, and the screws actually thread into brass inserts, not into the raw plastic.  A single cartridge can be reused many times, potentially lasting a fair portion of the life of the actual machine.  Parked right next to the drive wheels in a slot is the object of our interest, the EEPROM board itself:

Here’s what the front and back of the EEPROM PCB looks like:

In case anyone is wondering, the text on the chip itself is:

DS2433
1226B1
586AC

As noted in the original blog post, the chip is a DS2433 (originally a Dallas Semiconductor product, hence the ‘DS’, now owned by Maxim).  Importantly, it is a 1-wire device, hence requiring only 2 contacts to the chip.  As an aside, this nomenclature has always annoyed me – power and signal may be carried over a single wire, but you still need a ground connection.

Now, to extract those pesky bits from the EEPROM, all 4096 of them!  Technically, there’s a few more bits that we’ll need as well – a 48-bit serial number, 8 bits for CRC, and an 8-bit family code (0x23).  I’ve used a Bus Pirate before, and you can use an Arduino as well, but for this post I’ll be showing how to use a Raspberry Pi, since we can do everything on a single, standardized platform.  In this case, I’m using a Raspberry Pi model B with an Adafruit breakout board, and I started with a clean NOOBS image (v1.7.0 to be specific) on a freshly formatted SD card.

I booted the RasPi and was greeted with the installer – since I had the RasPi connected to my network, it provided me with network installation options, but I selected only the first option to install the Raspbian OS:

While that was installing, I prepped the breakout board.

I connected the black alligator clip to a GND (0vdc) terminal and the red alligator clip to IO4 on the breakout board (which is pin 7 of the RasPi header).  Note that pinouts on the RasPi can be very confusing – IO4 on the breakout board is not GPIO.4 on the RasPi as I had first thought, but pin 4 of the Broadcom BCM2835 processor at the heart of of the RasPi (also known as GPIO.7 on the RasPi).  You can read more about this confusion at wiringpi.com.  I connected a 2.2k resistor to a 5vdc terminal and the IO4 terminal – this acts as a pullup.

By this time, Raspbian had finished installing and I was looking at a fresh new desktop.  I find it easier to just SSH into the RasPi, so once I determined its IP address (just hover your mouse over the network icon in the upper right of the desktop), I could fire up PuTTY and connect right to a shell (you can certainly do everything via a terminal window on the desktop, though).

On a default install of Raspbian, the login is pi and the password is raspberry.  While Raspbian includes just about all the software we’ll need by default, the Python crypto library will be required later on, so run sudo apt-get install python-crypto right away to install that package (the RasPi will need to be network connected with internet access for this to work).  I then attached the breakout board to the RasPi and proceeded to do some testing with gpio to make sure that my wiring was correct.

I hooked up an oscilloscope to the red and black leads (you can use a multimeter, but a scope will let us see when EEPROM reads are occurring, which is handy when debugging), and saw that I had nearly 5vdc, which is just what I was expecting due to the 2.2k pullup resistor.

Now, let’s have a look at actually controlling the pin that the red alligator clip is connected to.  The gpio readall command gives us a snapshot of what the status is of all the header pins (again, see wiringpi.com for details).  By default, all the I/O pins are set to be inputs (note pin 7 is set as ‘IN’):

We can change the mode from input to output on that pin with gpio mode 7 out

And as soon as that command is issued, the voltage drops to zero:

Issuing gpio write 7 1 will bring that pin high:

Resulting in 3.3v output (RasPi digital I/O is 3.3v, not 5v):

That’s all for verifying that the wiring is correct.  There’s one final change to make before we can actually try reading in an EEPROM, and that’s disabling Device Tree (I understand it’s possible to get things working with DT enabled by means of some other configuration changes, but disabling it altogether is the route I went with).  Run sudo raspi-config to bring up the configuration menu, and select Advanced Options:

Then, select Device Tree:

Select ‘No’:

And DT will then be set as disabled:

Back at the main menu, select Finish and you’ll be prompted to reboot (select ‘Yes’):

With the RasPi rebooted, we’re finally ready to read in an EEPROM.  Recite the magic incantations sudo modprobe w1-gpio gpiopin=4 and sudo modprobe w1-ds2433 (note that you’ll need to run those commands again if you reboot the RasPi, so it may be worthwhile to add them to a startup script):

Now, connect the clips to the EEPROM – black clip to the ground pad, red clip to the data pad (you can tell which is the ground pad because it has a trace on all 4 sides connecting it to the ground plane):

If you have a scope hooked up, you’ll see that the voltage drops to 3.3 volts and then there will be a data read every 10 seconds or so:

We can cd /sys/bus/w1/devices/w1_busmaster1 to have a look at the connected 1-wire devices seen by the RasPi, and therein is a specific directory created for that EEPROM (23-0000014d4762 in this case – your EEPROM will be different!):

You can also use the xxd command to hex dump the EEPROM’s full UID as shown (0x2362474d0100006b).  This particular UID consists of the family code (0x23, which should be the same on all Stratasys P-class EEPROMs, except for those used on uPrint cartridges), the device serial number (0x62474d010000 – note the endianness) and finally the checksum (0x6b).  The screenshot also shows a dump of the 512 bytes of EEPROM data itself.  In order to actually do anything with this EEPROM data, though, we’ll need Benjamin’s code.

We’ll cd back to our user directory and then grab a .zip archive of the code via wget https://github.com/bvanheu/stratasys/archive/master.zip, after which we can extract it into a directory via unzip master.zip.

We’ll cd into that directory and try running the main program by executing ./stratasys-cli.py -h

This is just what we want to see!  If instead you get a number of errors mentioning crypto, make sure that you have the python-crypto library installed.  At this point, we don’t need to do any further configuration on the RasPi, and we can actually dive into the EEPROM data itself.  If you’ve managed to get this far, you’re probably capable of basic command line Linux work, so I’m going to gloss over those details from this point onward and let screenshots do most of the talking.  First, we’ll copy the EEPROM data out to a file that we can actually work with.

A directory listing confirmed that the resulting file is exactly 512 bytes in length, and all the formatting looks just like all the other Stratasys EEPROM dumps I’ve seen.  Let’s take one more look at the EEPROM UID, as we’ll need to format it correctly to feed into the stratasys-cli program:

We need to reverse the byte order of the shown UID, so instead of 23 62 47 4d 01 00 00 6b we’ll use 6b 00 00 01 4d 47 62 23 (remember, the family code of 0x23 is at one end, and the checksum is at the other end).  Here we finally feed the EEPROM UID and the EEPROM data through the program, using ‘prodigy’ as the machine type (any Dimension series machine should be ‘prodigy’, but a different machine type (Titan, Maxum, etc.) will have a different family name):

If you don’t have the UID formatted properly, the program will fail with a checksum error:

If we take a quick look at the data, everything agrees with the label that was on the cartridge – the color, serial number, manufacturing lot, and manufacturing date all match perfectly (I’m guessing that the timestamp on the EEPROM data is actually GMT).  Note that while the last use date is a separate entry in the EEPROM data, I’ve never seen it differ from the manufacturing date (maybe Stratasys intended to write this data back to the cartridge, but couldn’t be certain that the printer itself would actually have the correct day/time set).  A service manual I saw indicated that this timestamp was intended to be the date/time that the cartridge was actually first inserted into a machine, so perhaps Stratasys intended to have cartridges ‘expire’ after a certain amount of time.

The EEPROM stores material quantity in terms of cubic inches.  A brand new cartridge contains 56.3 cubic inches worth of filament, and the current level as shown on the EEPROM is under 0.75 cubic inches, so the 1% filament remaining message on the printer’s front panel was right on (there was actually a little more than that remaining on the reel, but the overage allows for nozzle purges, waste due to swapping cartridges, etc.).  The original hack worked by simply setting the current material quantity back to 56.3, but the printer would remember the serial number of the cartridge (and refuse to work with that cartridge serial again), so files needed to be deleted on the printer itself.  Since we can now create our own EEPROM images from scratch, we can simply change the serial number in addition to the material quantity, and the printer will be none the wiser.

In addition to decrypting the EEPROM data and displaying it in a human readable format, Benjamin’s program can provide all the parameters needed to generate that very EEPROM data, which is extremely handy.  We’ll simply tack on the -r option to the command we just used:

We only need to change the highlighted options to create our desired EEPROM image:

Reading the generated neweeprom.bin file back through the program shows that the serial number is now different (I incremented the value by 1000 rather than 1 just in case there were consecutively serialized cartridges the machine had already seen), and the material quantity is back to ‘full’.  Now, we can finally write that file back to the EEPROM itself (remember to use sudo when writing to the EEPROM due to permissions):

A quick hexdump directly from the EEPROM verifies that we’ve modified the contents successfully.  Note that the new image we generated is only 113 bytes, while the original EEPROM data is a full 512 bytes.  This is because everything after the ‘STRATASYS’ at 0x69 is random garbage (early on, Stratasys simply padded out 0x71 onwards with zeros), so that portion of the EEPROM can be left unchanged.  That’s all that we need to do with the RasPi – the EEPROM can be disconnected and set aside.  All that remains is to reload the cartridge with fresh material.

My favorite current filament is the ‘High Performance ABS’ from Coex3D – I’m partial to them because they’re local, their product quality is excellent, and Chris gave an amazing presentation on polymer processing and filament extrusion to our 3D printing user group a few years ago.  He listened to my pleas for MG94 filament and thankfully started producing it.

While Coex3D reels fit right into my FDM series machines, they don’t fit into P-class cartridges (the bore is just a little too small, and there is a rubber piece attached to the top shell of the cartridge that would interfere anyhow).  So I needed to respool the new filament onto the old reel.

In fact, respooling the filament itself is probably the hardest part of the entire process!  I admittedly got a bit hackish with the use of electrical tape as a makeshift drive dog, but it worked.

Make sure that you have the desiccant packets in place, the EEPROM PCB in its slot, and the drive wheels in position, then very carefully feed the end of the filament through the hole in the disc portion of the gasket.  Hold the filament in its guide slot, and carefully place the top shell half back in place (this is pretty tricky without having the gasket jump out of place).  Flip it over, assemble the cartridge with the 4 screws, and our work is complete.  Now, for the moment of truth…

After loading the refilled cartridge into the printer, it showed a 100% full model spool!

Of course, the proof is in the prints, and the machine is now happily churning out parts far more inexpensively than before (and with better material properties than the OEM P400 filament had).

Notes:

1) Benjamin’s code works for other Stratasys printer families as well, including the big T-class and Maxum/Quantum machines.  It will even decrypt and generate binary images for uPrint cartridge EEPROMs.  However, uPrint cartridges use a different EEPROM model that unfortunately utilizes an HMAC authentication scheme for writes.  So while you can read EEPROMs and generate new .bin files, actually writing them back to the EEPROM is impossible without knowledge of the secret key used for the HMAC authentication.  If you only have access to a uPrint, you’re kind of stuck. [12FEB2017 addendum]  It turns out that an HMAC protected EEPROM can be re-written by using the DIAG port on the printer.  ‘Odin’ discovered this workaround and authored these concise instructions for the hack.  This isn’t quite ‘touchless’, but until someone breaks or sidesteps the HMAC protection, it’s the best option.

2) 56.3 cubic inches isn’t actually the maximum material quantity you can set on the EEPROM.  It’s a floating point number, so the sky is the limit!  However, on a P-class machine, 60.0 cubic inches is the maximum that the printer will accept as valid, as anything larger will instead be considered zero. [22FEB2017 addendum] Reports indicate that larger volumes can be used, but the ‘initial material quantity’ field needs to be similarly large.  However, others (Odin, for one) find that this doesn’t work on their machine, so this could be a difference between firmware revisions.

3) I mentioned using an Arduino to read/write the EEPROM.  There’s actually a fork of Benjamin’s code available on github called CartridgeWriter that runs in Windows and interfaces with an Arduino for EEPROM reads/writes.  I haven’t tried it myself, but others have used it successfully.  I prefer running Benjamin’s code directly on a RasPi due to the amount of control it provides.  Specifically, it makes some automation possible, such as…

4) …this clever little EEPROM rewriter made by Sneaks Hacks.  He’s posted the wiring schematic and STL files for the housing, and is currently working on an updated version as well as documentation for people wanting to build their own.

5) The Stratasys EEPROM PCB has a surface mount 4.7k pulldown resistor right next to the DS2433.  While most wiring schematics for reading/writing a Stratasys EEPROM show to use a 4.7k pullup between 5v and the data pad, I used a 2.2k to help ensure that voltage to the DS2433 remains in an acceptable range.  You can certainly start with a 4.7k pullup and reduce the resistance if you’re having flaky results, but I don’t think I’d go below 2.2k.

6) Benjamin notes that use of the –output-file option when generating EEPROM images isn’t actually correct in a traditional Unix sense, and that I/O redirection is really the proper Unix way to get binary output from stratasys-cli.py (that is, using something like ./stratasys-cli.py –foo –bar > my_file.bin).  I think using –output-file is a little easier to see and understand what’s going on, but if you’re building an automated system like Sneaks Hacks did, using stdout can help streamline the processing chain.  For example, you could write directly to the EEPROM and save a backup of the image all in one go by using something like ./stratasys-cli.py –foo –bar | tee backup_image.bin /sys/bus/w1/devices/w1_bus_master1/23-0000014d4762/eeprom.

7) Everything in this post is simply the compilation and distillation of other people’s hard work – I simply wanted to bring it to a wider audience.  These are the folks who deserve all the credit:

  • Huge thanks goes to Mjolinor, who I believe was the first to pioneer using a RasPi as an all-in-one solution for rewriting Stratasys EEPROMs.
  • Thanks to the anonymous and unnamed people (you know who you are) who have assisted in developing and testing these techniques over the past few years and helped review this post before publishing.
  • Steve, Joe, and John at Into3D LLC for letting me use their Dimension BST 768 as the guinea pig for this project.
  • First, last, again, and finally, Benjamin Vanheuverzwijn.  This man is an absolute electronic wizard and none of this would have been possible without him.  Send him coffee.

98 thoughts on “Stratasys EEPROM hack revisted”

  1. What is the current state of refilling uPrintSE+. Cartridge eeproms are password protected from write events. Can we write to new eeproms and load those in? or is there othr problems aside from sourcing a compatible chip.

      1. Your answer is bit above my understanding.

        There is one commercial solution where a new eeprom is written as a fresh cartridge.

        Question :
        Why can we not write our read of a fresh data cart to a non pass work protected eeprom.

        *sending email.

  2. Is this do-able with the CubePro cartrages? They also use the DS28E01 chip, so looking at your reply to Johnny I assume that’s a no.

    1. 3DS uses their own data storage format on the EEPROM, so Benjamin’s code won’t work with them – I’m not sure if there are any similar projects to rewrite them.

  3. This was such a huge help! the new eeprom-holder stl files are so nice! I’m still tweaking my setup to match our workflow but man this is great.

    Keep up the work, your blogposts are golden!

      1. I’m surprised you didn’t comment on the “I’m pooping” comment. I believe I actually was pooping at the moment I posted that.

  4. I am attempting to read off the eeprom data but I am not seeing any response on the scope with the above configuration. I am also not seeing the serial number in w1_bus_master1. I am applying 3.3v power and ground as per the above instructions. Any suggestions?

  5. The version of raspbian does not include this option in raspi-config but there is a option to turn 1wire on and off.

      1. It did not work and I am unable to find a NOOBS download for version 1.7.0 would you be able to point me in the right direction as to were that would be located?

          1. Add this line (dtoverlay=w1-gpio) to /boot/config.txt? Is this the same as disabling DT?

          2. No, that doesn’t disable DT – that’s the proper way to use 1-wire with DT. I opted to go the non-DT route so that my guide wouldn’t require directly editing any files (hopefully keeping things a little simpler for users).

            If Andre is correct regarding new builds not allowing for DT to be disabled, then you’ll definitely need to use dtoverlay.

  6. I started with RasPi3B, Noobs 1.9.2 today. Installed and also found out that DT is not available. Configured 1Wire as on and continued all the other steps. Worked fine and the reprogramming is functional.
    System: Stratasys diemension SST 1200es

  7. I tried to CD into the eeprom data and reading it using xxd as mentioned in your post. But it returned ” xxd: 2362474d0100006b: permission denied

    Any idea why?

  8. Yes. I tried sudo xxd -p id 23-000001174f17. I got xxd: 23:0…7: permission denied

    This was the only bottleneck. I went ahead with the rest and got exactly similar results as yours. But when I plugged it to the 3d printer the cartridge still showed empty(just as before). Any chance I can contact u through mail? Hjjkrishnan@gmail.com

  9. Great info! Thanks for the tutorial. I managed to get this to work perfectly on our Dimension 1200es. However, I used Cartridge Writer GUI and an Arduino – The whole process from nothing to a working setup took me no more than 15 mins. That GUI simple to use but has a couple of bugs that can be worked around, or fixed if anyone feels like it, as the source is all available.

    While going through some of our spent cartridges I noticed some of the newer ones (e.g. Mfg Date: Jan 2016) had different looking PCBs. I took one apart and noticed it has a DS24B33 on it as well as another IC + some more passive components.

    I think it’s a 555 timer (http://www.intersil.com/content/dam/Intersil/documents/icm7/icm7555-56.pdf). Not sure what they are using it for thought. Thoughts?

    7555
    CABZ
    LF23FEV

    I was still able to read it with no issues and also write to it. Haven’t tried it in the printer as I’m concerned it could ‘brick’ it or something.

      1. Well, that certainly is interesting! I’m not sure why they’d add a 555 timer to the circuit, but I’d guess that it’s something to do with using the DS24B33 versus the original DS2433. This application note covers differences between the two, and I’m assuming the 555 must be accommodating notes 1 and/or 2, the longer read low time and recovery time on the ‘B’ model of the chip.

        1. I think you’re correct.

          Interesting that they opted to add more cost to the cartridges rather than push a firmware update to the printers to rectify. Maybe it may have not been possible or probably a better “user experiance” this way.

          Plus they afford to ship those cartridges with a little gold if they wanted to – those things are damn expensive.

  10. Does anyone know what the legalities of doing this hack are?

    Our printer is out of warranty and we don’t have a service agreement but we do get them to come out and service the machine every now and then when something goes wrong. Would they start to refuse to offer support?

    Can they legally brick the printer if they detect someone has tampered with the cartridges? (Maybe not now but in future if they update firmware etc).

    We’re commercial users of the printer and the price of the cartridges has gone out of control. We’re spending many thousands per month on material. It’s almost no longer viable to continue to use it hence me searching for alternatives.

    1. As far as copyright law is concerned (if Stratasys could even somehow claim copyright protection on the EEPROM data), you are clear and free – Public Knowledge has a little bit of info (hat tip and high-five to Michael Weinberg, who is an all-around awesome dude).

      On a more practical level, Stratasys has no way to tell that you’ve used third party filament. After all, this hack is 100% touchless and does not need any modification of the printer itself. Any firmware updates that they make need to be absolutely solid, and I cannot imagine that they would ever intentionally brick a machine. My day job is working for an industrial machinery manufacturer – on the extremely rare occasion (only once as far as I know) that we’ve even coded the capability to brick a machine, it was done with the end customer’s full knowledge and consent (customer couldn’t afford full purchase price, so we negotiated a reduced price, but the machine would lock up after a set number of cycles. If the customer paid the remainder, we’d provide an unlock code to remove any limits).

      I’ve dug through some Stratasys code, and their people are very conscientious about making darned sure that the machine is operable after a firmware update. I don’t think you have anything to fear – the vast majority of Stratasys operators have no idea that third party materials are available, that this hack exists, etc., and Stratasys is happy to keep it that way.

  11. Hello!) Could you please help me
    I write
    ./stratasys-cli.py eeprom -t prodigy -e 6d0000015d66b823 -i original23-0000015d66b8.bin
    and received

    Exception: invalid content checksum: should have 0x6658 but have 0x7c0a

    I have Dimention elite BST or SST 768
    EEPROM id 23b8665d0100006d
    reverse 6d0000015d66b823

    I try write fox,fox2, prodigy and ather, but also reveive checsum error with other num

  12. Does anyone have a new generation board I can buy off of them, I am looking to make some replacement boards for myself and the old eeprom is no longer available so I want to see if I can make a clone of one of the newer ones

    Thanks
    Calvin

  13. Thank you very much! Working with old cartridges (2010-2013) and everything works like a charm!
    Very much grateful!

  14. “12FEB2017 addendum] Reports indicate that larger volumes can be used, but the ‘initial material quantity’ field needs to be similarly large.”

    On my SST 1200es it is not possible to use larger volumes than 60 cuin in the “current quantity” field. I can set every quantity in the initial field but current is limited to 60cuin. Every higher volume causes an error in the SST 1200es.

  15. Hello , we have couple of Fortus 250 MC Machines , can any one tell me this tutorial works on the same , if not what’s the alternative . Thanks

  16. Hey I’ve got a problem reading data from the DS2433…
    Every time I pull/test data, it’s different. I ran
    watch -d -n 1 xxd /sys/bus/w1/devices/23-000001418587/eeprom
    and see what happens:

    https://ibb.co/kqf1MQ
    https://ibb.co/euxRo5
    https://ibb.co/cWcRo5
    https://ibb.co/eoYMMQ
    https://ibb.co/eTz6o5
    https://ibb.co/kPhgMQ
    https://ibb.co/cR4Hvk
    https://ibb.co/mw681Q
    https://ibb.co/j18z85
    https://ibb.co/m5NgMQ
    https://ibb.co/b4HsT5

    How is this possible? My wiring is exactly like yours. Drivers work fine. Ran the setup with a 2.2k resistor, a 1.5k resistor, no pull-up at all. Every time the same problem. (Though sometimes the no-pull-up-setup didnt give me any data, sometimes it did)

    1. Can you try it with a different EEPROM? Everything after the ‘STRATASYS’ is garbage, so as long as you can get a clean read up to that point, it’s all you need.

      1. Oh yes. Fantastic! Wrote you java app that handles reading.
        Lists all the connected chips, reads the chips multiple times, then gets the most probable byte combination. Usually has a reliability of 99.3%. Stores it into a file. Dumps the complete stratasys-cli call, so you only have to copy-paste it.

        Re-coded the chip and read it again, all perfectly fine.

        Now I’ll extend the app to handle all the steps.
        So just connect the chip, backup is made, id and quantity are refreshed and written back to the chip in one go.

        Thanx for all the help and the great description.
        I’ll drop a link to that project later.

  17. I have a fortus 400 MC, somebody knows if this method works with it?

  18. Hi,

    I am a noob in this, but we have a uPrint SE Plus, but the eeprom looks different:

    [IMG]http://i65.tinypic.com/2ic9krt.jpg[/IMG]
    [IMG]http://i64.tinypic.com/io22l1.jpg[/IMG]

    How do I program those?

    1. You’ll need to create the .bin file separately and program the EEPROM via the DIAG port on the printer itself, since that model printer uses cryptographically write-protected EEPROMS. You can find information in this thread.

  19. Very important to know is, that empty eeprom of the uPrint are read only. You need afaik at least 1% filling left to write the eeprom via diag port l.

  20. Has someone used this on a fortus 400 mc cartridges?
    it also has a ds 2433 chip, so should it work?

  21. AFAIK yes. You have to use “fox” as printer type for generating a new one.

    For example with bvanheu’s tool:
    stratasys-cli.py eeprom –machine-type fox–eeprom-uid ffdc00000034f8d223 –serial-number 489435455.0 –material-name NYL12 –manufacturing-lot 7567 –manufacturing-date “2017-01-01 01:01:01” –use-date “2017-01-01 01:01:01” –initial-material 92.0 –current-material 92.0 –key-fragment 55aa55c395bf4ebe –version 1 –signature STRATASYS -o 400MC.bin

  22. Hello, we are students that are working in a company. We have a problem that we don’t know how to resolve: when we copy the neweeprom.bin file into the chip and put it into the printer, it says “Model empty” or “Could not read model”. Could you help us, please?
    (Sorry for our English, we are Italian)

    1. Which model printer are you working with? How did you create the new image file? Did you verify that it was written back to the EEPROM properly?

      1. Thank you for the answer. We realized that we were not modifying the serial number, so the printer was saying that.
        Last question: is it possible to do all of this automatically during the boot of the Raspberry Pi ?

  23. Very cool, do you think you could use the same process for newer catridges on more advanced machines? e.g. Stratasys F270? would be happy to send you a chip flagged 0% to try?

    1. Stratasys already is ahead of the game due to their use of SHA-1 protected EEPROMs in the uPrint series (which are furthermore supposedly designed to brick themselves when reduced to 0% material remaining in an effort to foil this sort of hack). It wouldn’t surprise me at all if the F-series machines have an entirely different EEPROM data structure, given how much of a break the machines are from the existing P- and T-class units. At any rate, I’d be interested in at least seeing the contents of any F-series chips… Drop me a line at haveblue@haveblue.org

  24. Hello Have Blue,
    Following your steps (except for using gpio 21 instead of 7, I made it up until where I should be seeing the eeprom on the terminal window.
    http://oi63.tinypic.com/seosip.jpg
    It doesnt seem to be reading the eeprom though I am getting a voltage reading of 4V across the across the circuit..
    I should mention that once I entered the setmode 21 out command, I saw no voltage drop. Again there was no voltage drop when I wrote a value of 1 to pin 21.
    Could you give help me please?

      1. I tried that now. No difference. I am also using the newer eeproms (the one Ham referred to). I did try it with one of the older ones as well.

        1. seems like I had some wiring issues. That’s all cleaned up and I see the same readings (3.3V). I still cannot probe the eeprom. The 1 wire mode is enabled as well.

          1. I don’t have any good ideas, other than maybe getting one of those 1-wire thermistor devices I recall from a RasPi howto in order to verify proper 1-wire operation first.

  25. These simple steps still work nearly two years later in 2017! Fantastic step by step directions. Thank you to everyone involved.

    1. Note: With RPI3 there is no need to disable the device tree. Simply enable 1-wire in raspi-config, reboot and off you go!

  26. I got it to read the eeprom finally.
    Though I got the same “permission denied” message that Jay had gotten. Not sure what to do now. The rest of the steps worked though the printer showed the cartridge as empty.

        1. I actually misinterpreted your code: where I was to enter xxd -p id, I also typed in the id in the line beneath that, not realizing that that was the output, not a continuation of the previous input.
          Jay told me to try the complete path “xxd -p /sys/bus/w1/devices/w1_bus_master1/23 -000001174f17/id” and that is when I realized I ducked up.

  27. Hi everyone!
    It seems that new stratasys printers use different cartriges wich use an other component ( not a Maxim DS2433 one-wire EEPROM anymore…) Is there someone who have information about that ?
    Thank you very much in advance ! =)

  28. I have 2 Stratasys 380MC and 1 450MC. The eeprom in the cartridges seems not like to a DS2433. As i tried i think it is possible to read the content of the eeprom but it seems like impossible to write.

    1. Correct – the DS2432 (or workalike) uses SHA-1 authentication for writes. Without knowledge of the secret key, it is impossible to re-write the EEPROM.

  29. Hello, first of all thank you for this kind of guide, resulted very useful even to improve my knowledge.

    I got a problem in the last part of the copy the neweeprom into the eeprom getting an input/output error while writing, the eeprom that I’m testing with is the DS24B33, dunno if the eeprom have a SHA-1 authentication

    Everything worked well, but the last copy part.

  30. I am trying this with a Next Thing Co. CHIP instead of an Arduino. It did require recompiling the kernel to get it to be able to talk to the ds2433 EEPROM.

    After this I was able to follow the relevant directions here fairly well.

    I got as far as reading the EEPROM and then as far as creating a new, altered encrypted image and dumping it into a file (the file was verified to be correct and changed).

    Then I got stuck because something (I don’t know what) is protecting the file from being written. When I try the cp command I get “cp: error writing ‘/sys/bus/w1/devices/w1_bus_master1/23-0000007b6aec/eeprom’: Invalid argument” and “cp: failed to extend ‘/sys/bus/w1/devices/w1_bus_master1/23-0000007b6aec/eeprom’: Invalid argument” (and yes, I used sudo). I have also tried the ‘cat’ command with redirection (as in “sudo cat something > something_else”) and the dd command (again, I did not forget sudo). The ‘cat’ command responds with “Permission denied” and dd gives no errors but doesn’t actually do anything (that is, looking at the eeprom contents I can see that they are unchanged).

    I see nothing odd with permissions. The target file (‘/sys/bus/w1/devices/w1_bus_master1/23-0000007b6aec/eeprom’) is set writable by root (which I would have thought should have prevented this sort of error).

  31. I wonder if it’s a hardware issue? Could it be that the 3.3V logic on the chip is sufficient to read the DS2433 but not suficient to write it?

    Looking at a data sheet (https://goo.gl/Jyk1vB ), the caption for figure 8 is as follows:

    5kΩ IS ADEQUATE FOR READING THE DS2433. TO WRITE TO A SINGLE DEVICE, A 2.2kΩ RESISTOR AND VPUP OF AT LEAST 4.0V IS SUFFICIENT. FOR WRITING MULTIPLE DS2433s SIMULTANEOUSLY OR OPERATION AT LOW VPUP, THE RPU SHOULD BE BYPASSED BY A LOW-IMPEDANCE PULLUP TO VPUP WHILE THE DEVICE COPIES THE SCRATCHPAD TO EEPROM. DEPENDING ON THE 1-Wire COMMUNICATION SPEED AND THE BUS LOAD CHARACTERISTICS, THE OPTIMAL PULLUP RESISTOR (RPU) VALUE WILL BE IN THE 1.5kΩ TO 5kΩ RANGE.

  32. So why can’t all of this be done, via SSH, from the Stratasys itself?

    Shouldn’t the unchanged Python scripts work unchanged in these machines?

    Even if the device names are different, it should still have something, somewhere that has “w1_busmaster1” in its name (or something very much like it) and something, somewhere that has “w1_busmaster2” in its name (or something very much like it).

    Then the EEPROM chips (one for the model and one for the support) should somehow show up in the respective device tree branches coming down from that (one at w1_busmaster1 or its equivalent and the other at w1_busmaster2 or its equivalent). And then the only trick is that you need to read from that or write to that (as the case may be). The Python scripts don’t even care about that since it just gets passed as a parameter.

    So, really, the only thing that the printer (in my case the one I have access to is a Dimension 768 BST) requires for this to work is to have Python 2.x installed (more difficult than it should be —because rpm is broken in the 768 BST— but ultimately not that difficult) and to have the Python crypto library installed (and to get the scripts, of course).

    Am I missing anything here?

  33. I connected a 2.2k resistor to a 5vdc terminal and the IO4 terminal – this acts as a pullup.

    Why exactly can we do this? I was assuming that these pins on the Pi would be 5V tolerant but what I am reading suggests otherwise. Why aren’t we zapping that pin with too much voltage when connecting it to a 5V rail?

  34. By the way, your link to Odin’s hack on Note 1 actually points to a private network address (192.168.0.0 – 192.168.255.255 block).

  35. I have a larger Stratasys Fortus 400/450/900 FDM canister P/N:355-02110 (ABS-M30) that I would like to figure out how to reset. Care to take a crack at it? if you do not have one I could ship one to you….

  36. Recently I tried to rewrite another eeprom and discovered that it wouldn’t read. I checked all the connections, went through all the steps again, I even got a new raspberry pi and still it wouldn’t work. In the w1_bus_master1 directory the eeprom id starting with 23 would not appear, only something like 00-xx00000000. The xx would change every now and again. The voltages that I read from my multimeter are the same as last time.
    I tried downgrading to NOOBS 1.7 which also did not make a difference.
    It’s so strange because I was able to pull this off once and now it’s failing me. I would really appreciate any tips for solving this problem.

  37. Anyone got a good replacement for the break away support material P400R? I understand it’s a high impact polystyrene (HIPS), but of course print temp, and quality can vary greatly. I’m currently using Coex LLC’s mg94 in liu of the ABS P400.

  38. i would very much be interested in any developments for a Uprint, at the moment its the most expensive paperweight i own. or is this thread dead?

  39. hello thanks .i have a 3d printer
    (projet 1200 3dsystem) and iwant to charge the empty cartridge . can i use the way you say above for my cartridge. woud you tell me complete way , please

  40. Hi,
    Since january, our printer doesn’t accept the reprogrammed cartridges any more.
    Do you know of any Update on the printer or of a problem with the software that could have occured since then?
    Everything was working fine last year.
    Thank you

  41. uprint se which is the hack? arduino and cartridge writer does not work. chip is 4point contact chip. i tried one wire. software shows error in crc16 checksum error. bin file is recorded. please guide me step by step. i tried lot of post. got confused now.

  42. My employer has purchased the f370 or essentially the f123. He has tasked me with finding a way to reset the canisters. Anyone have any info on this model? Has it been hacked yet?

    1. Unfortunately, I’m not aware of any work having been done on the F123 series machines yet. I honestly don’t know anything of their architecture!

  43. Have you heard if the eeprom hack works on the stratasys mojo? I recently received one of these from the school district I work at with plenty of support cartridges and build plates but no model material. I am hesitant to buy a model cartridge that’s seems to be running about $400 bucks without knowing If I can refill it. If you have any info you can message me at vegasvento (@) Gmail (dot) com thanks for your work on gathering l of this information!

    1. Unfortunately, I have heard nothing regarding hacks on the Mojo. Since it uses a weird filament size, disposable nozzle/drive units, and highly specialized software, I’d just sell it off on Ebay. Honestly, I don’t think the Mojo has any redeeming qualities at this point compared to hobbyist machines.

  44. Does anybody knows if it is possible to duplicate a EEprom chip? I guess the a checksumm is generated with the UID. This Checksum would then not be right for the new Chip because UID is differnet. Does anybody knows how the Checksumme is calculated? Is there the UID included? I am not good in programming and cannot read it from the “.py” scripts

  45. Has anyone come up with a hack solution for rewriting the F123 series? Would commission someone to figure this out.

Comments are closed.