Hi. I have Projet 1200 mSLA 3D-printer. 3DSystems doesn't allow 3rd party resins (cartridge) to be used, so I've just reused old genuine cartridge by refilling it with 3rd party resin (FunToDo) and it works fine. Now software says, that cartridge is empty and doesn't print anymore. Printer firmware/software is build on Beaglebone Black, I was able to get root access to system. There sees to be one binary (landerAppV.x.x.xx.x) that controls whole printer. I've tried to reverse engineer that and try to hack it so that either bybass the cartridge quantity check or return static value (always full?), but haven't succeeded yet. Spoiler / (fcn) sym.iGetCartridgeCurrentQty 104 | sym.iGetCartridgeCurrentQty (int arg4); | ; var int local_8h @ fp-0x8 | ; arg int arg4 @ r3 | ; XREFS: CALL 0x000108d8 CALL 0x0001383c CALL 0x00013960 CALL 0x00013a1c CALL 0x00014504 CALL 0x00014670 | ; XREFS: CALL 0x00014b44 CALL 0x0001550c CALL 0x00015760 CALL 0x000159f4 CALL 0x00015d0c CALL 0x00032e10 | ; XREFS: CALL 0x0008dd2c | 0x0008aeb0 00482de9 push {fp, lr} | 0x0008aeb4 04b08de2 add fp, sp, 4 | 0x0008aeb8 08d04de2 sub sp, sp, 8 | 0x0008aebc 0030a0e3 mov r3, 0 | 0x0008aec0 08300be5 str r3, [local_8h] ; 8 | 0x0008aec4 4c009fe5 ldr r0, obj.cartridge_mutex ; [loc._d_6345:4]=0x1683dc obj.cartridge_mutex | 0x0008aec8 120ffeeb bl sym.imp.pthread_mutex_lock | 0x0008aecc 48309fe5 ldr r3, obj.boLoadedCartridgeData ; [0x8af1c:4]=0x1683d8 obj.boLoadedCartridgeData | 0x0008aed0 0030d3e5 ldrb r3, [r3] ; 0x1683d8 ; obj.boLoadedCartridgeData ; arg4 | 0x0008aed4 000053e3 cmp r3, 0 | ,=< 0x0008aed8 0800000a beq 0x8af00 | | 0x0008aedc 3c309fe5 ldr r3, obj.abPage1Data ; [0x8af20:4]=0x16b800 obj.abPage1Data | | 0x0008aee0 003093e5 ldr r3, [r3] ; 0x16b800 ; obj.abPage1Data ; arg4 | | 0x0008aee4 08300be5 str r3, [local_8h] ; 8 | | 0x0008aee8 08201be5 ldr r2, [local_8h] ; 8 | | 0x0008aeec 30309fe5 ldr r3, aav.0x0000ea60 ; [0x8af24:4]=0xea60 aav.0x0000ea60 | | 0x0008aef0 030052e1 cmp r2, r3 | ,==< 0x0008aef4 0100009a bls 0x8af00 | || 0x0008aef8 0030a0e3 mov r3, 0 | || 0x0008aefc 08300be5 str r3, [local_8h] ; 8 | || ; CODE XREFS from sym.iGetCartridgeCurrentQty (0x8aed8, 0x8aef4) | ``-> 0x0008af00 10009fe5 ldr r0, obj.cartridge_mutex ; [loc._d_6345:4]=0x1683dc obj.cartridge_mutex | 0x0008af04 6012feeb bl sym.imp.pthread_mutex_unlock | 0x0008af08 08301be5 ldr r3, [local_8h] ; 8 | 0x0008af0c 0300a0e1 mov r0, r3 | 0x0008af10 04d04be2 sub sp, fp, 4 \ 0x0008af14 0088bde8 pop {fp, pc} I also dumped cartridge chip (eeprom). -memsos
I reverse engineered elf binary and modified it by disabling cartridge check and writing new max quantity when cartridge gets empty. Code: [8/13/2019 18:26:45] LOG_INFO [HandleMessage] :MM_START_BUILD - Message Method: 11 [8/13/2019 18:26:45] LOG_INFO [StartBuildJob] :Starting to build: lock_spring [8/13/2019 18:26:45] LOG_INFO [StartBuildJob] :Build Start time: 1.56572e+09 [8/13/2019 18:26:45] LOG_INFO [loadCartridge] :Cartridge Loaded [8/13/2019 18:26:45] LOG_INFO [loadCartridge] :Cartridge Serial number: 420010479E5 [8/13/2019 18:26:46] LOG_INFO [loadCartridge] :Current quantity: 0 [8/13/2019 18:26:46] LOG_INFO [CheckCartridgeQuantity] :Cartridge quantity was found to be more than Starting quantity, Current Quant: 0 [8/13/2019 18:26:47] LOG_INFO [CheckCartridgeQuantity] :Cartridge quantity was found to be more than Starting quantity, Starting Quant: 30000 [8/13/2019 18:26:47] LOG_INFO [CheckCartridgeQuantity] :Cartridge quantity was found to be more than Starting quantity, Resetting current quant: [8/13/2019 18:26:48] LOG_ERROR [StartBuildJob] :Cartridge Empty [8/13/2019 18:26:48] LOG_INFO [SendEventResponse] :Responding to Message Method: 11 [8/13/2019 18:26:49] LOG_INFO [projector] :Build file and Directory removed [8/13/2019 18:26:49] LOG_INFO [SendEventResponse] :Responding to Message Method: 11 [8/13/2019 18:27:15] LOG_INFO [HandleMessage] :CARTRIDGE INFO - Message Method: 16 [8/13/2019 18:27:15] LOG_INFO [getCartridgeDetails] :Cartridge Loaded [8/13/2019 18:27:16] LOG_INFO [getCartridgeDetails] :Current quantity: 60000 [8/13/2019 18:27:16] LOG_INFO [getCartridgeDetails] :Cartridge Valid [8/13/2019 18:27:16] LOG_INFO [getCartridgeDetails] :Material quantity in the cartridge: 30000 [8/13/2019 18:27:16] LOG_INFO [getCartridgeDetails] :Percentage of Material remaining in the cartridge: 100 [8/13/2019 18:27:16] LOG_INFO [SendCartridgeInfo] :Responding to Message Method: 16 [8/13/2019 18:27:16] LOG_INFO [HandleMessage] :CARTRIDGE INFO - Message Method: 16 [8/13/2019 18:27:17] LOG_INFO [getCartridgeDetails] :Cartridge Loaded [8/13/2019 18:27:17] LOG_INFO [getCartridgeDetails] :Current quantity: 60000 [8/13/2019 18:27:17] LOG_INFO [getCartridgeDetails] :Cartridge Valid [8/13/2019 18:27:17] LOG_INFO [getCartridgeDetails] :Material quantity in the cartridge: 30000 [8/13/2019 18:27:17] LOG_INFO [getCartridgeDetails] :Percentage of Material remaining in the cartridge: 100 [8/13/2019 18:27:17] LOG_INFO [SendCartridgeInfo] :Responding to Message Method: 16 And after that I tried to print something.. and it worked fine! Code: [8/13/2019 18:49:36] LOG_INFO [LanderBuildModel:LanderPrintModel] :Layer number: 2 [8/13/2019 18:49:36] LOG_INFO [LanderBuildModel:LanderPrintModel] :Considered duration for layer: 123.299 [8/13/2019 18:49:36] LOG_INFO [LanderBuildModel:LanderPrintModel] :Remaining Time: 109.89 [8/13/2019 18:49:36] LOG_INFO [LanderBuildModel:LanderPrintModel] :Remaining Time on Display: 110 [8/13/2019 18:49:36] LOG_INFO [LanderBuildModel:LanderPrintModel] :Percent complete: 0 [8/13/2019 18:49:38] LOG_INFO [LanderBuildModel] :Projecting: models/system20_bracket_40-40mm_square.vbf17-45-17/00003_01_s_004000.png [8/13/2019 18:50:19] LOG_INFO [SendBuildState] :Responding to Message Method: 17 [8/13/2019 18:50:20] LOG_INFO [SendBuildState] :Responding to Message Method: 17 [8/13/2019 18:50:20] LOG_INFO [SendBuildState] :Responding to Message Method: 17 [8/13/2019 18:50:21] LOG_INFO [LanderBuildModel] :Projecting: models/system20_bracket_40-40mm_square.vbf17-45-17/00009_01_s_004000.png [8/13/2019 18:50:24] LOG_INFO [SendBuildState] :Responding to Message Method: 17 [8/13/2019 18:50:25] LOG_INFO [LanderBuildModel:LanderPrintModel] :Layer number: 9 [8/13/2019 18:50:25] LOG_INFO [LanderBuildModel:LanderPrintModel] :Considered duration for layer: 7.29881 [8/13/2019 18:50:25] LOG_INFO [LanderBuildModel:LanderPrintModel] :Remaining Time: 109.039 [8/13/2019 18:50:25] LOG_INFO [LanderBuildModel:LanderPrintModel] :Remaining Time on Display: 109 [8/13/2019 18:50:25] LOG_INFO [LanderBuildModel:LanderPrintModel] :Percent complete: 1 [8/13/2019 18:51:28] LOG_INFO [LanderBuildModel:LanderPrintModel] :Layer number: 18 [8/13/2019 18:51:28] LOG_INFO [LanderBuildModel:LanderPrintModel] :Considered duration for layer: 7.29881 [8/13/2019 18:51:28] LOG_INFO [LanderBuildModel:LanderPrintModel] :Remaining Time: 107.944 [8/13/2019 18:51:28] LOG_INFO [LanderBuildModel:LanderPrintModel] :Remaining Time on Display: 108 [8/13/2019 18:51:28] LOG_INFO [LanderBuildModel:LanderPrintModel] :Percent complete: 2 [8/13/2019 18:51:29] LOG_INFO [SendBuildState] :Responding to Message Method: 17 [8/13/2019 18:51:30] LOG_INFO [SendBuildState] :Responding to Message Method: 17 [8/13/2019 18:51:30] LOG_INFO [SendBuildState] :Responding to Message Method: 17 [8/13/2019 18:51:31] LOG_INFO [LanderBuildModel] :Projecting: models/system20_bracket_40-40mm_square.vbf17-45-17/00019_01_s_004000.png [8/13/2019 18:51:34] LOG_INFO [SendBuildState] :Responding to Message Method: 17 [8/13/2019 18:51:35] LOG_INFO [SendBuildState] :Responding to Message Method: 17 [8/13/2019 18:51:35] LOG_INFO [SendBuildState] :Responding to Message Method: 17 [8/13/2019 18:51:36] LOG_INFO [LanderBuildModel:LanderPrintModel] :Layer number: 19 [8/13/2019 18:51:36] LOG_INFO [LanderBuildModel:LanderPrintModel] :Considered duration for layer: 7.29881 [8/13/2019 18:51:36] LOG_INFO [LanderBuildModel:LanderPrintModel] :Remaining Time: 107.822 [8/13/2019 18:51:36] LOG_INFO [LanderBuildModel:LanderPrintModel] :Remaining Time on Display: 108 [8/13/2019 18:51:36] LOG_INFO [LanderBuildModel:LanderPrintModel] :Percent complete: 2 [8/13/2019 18:51:39] LOG_INFO [LanderBuildModel] :Projecting: models/system20_bracket_40-40mm_square.vbf17-45-17/00020_01_s_004000.png I also tested same cartridge with unmodified binary, printer recognized it 100% full and printed normally.
Hi.. can you explain how to change the code? I'm not good in coding.. how can i open the coding page and modified it? Thank you
Daer Memsos, I tryed your solution. But doesn't work for me COuld you help me? I'M now root. I changed the modded landerV1.0.53.0 app in linux. I put an empty cartridge, try print (Geomagic Print 1.2.7 ), but the software always say, put a new cartridge, because this is empty. Let me know. Thank you Log: [1/1/2000 3:27:16] LOG_INFO [HandleMessage] :CARTRIDGE INFO - Message Method: 16 [1/1/2000 3:27:16] LOG_INFO [getCartridgeDetails] :Cartridge Loaded [1/1/2000 3:27:17] LOG_INFO [getCartridgeDetails] :Current quantity: 0 [1/1/2000 3:27:17] LOG_INFO [getCartridgeDetails] :Cartridge Valid [1/1/2000 3:27:17] LOG_INFO [getCartridgeDetails] :Material quantity in the cartridge: 0 [1/1/2000 3:27:17] LOG_INFO [getCartridgeDetails] ercentage of Material remaining in the cartridge: 0 [1/1/2000 3:27:17] LOG_INFO [SendCartridgeInfo] :Responding to Message Method: 16 [1/1/2000 3:32:22] LOG_INFO [HandleMessage] :CARTRIDGE INFO - Message Method: 16 [1/1/2000 3:32:22] LOG_INFO [getCartridgeDetails] :Cartridge Loaded [1/1/2000 3:32:22] LOG_INFO [getCartridgeDetails] :Current quantity: 0 [1/1/2000 3:32:22] LOG_INFO [getCartridgeDetails] :Cartridge Valid [1/1/2000 3:32:22] LOG_INFO [getCartridgeDetails] :Material quantity in the cartridge: 0 [1/1/2000 3:32:22] LOG_INFO [getCartridgeDetails] ercentage of Material remaining in the cartridge: 0 [1/1/2000 3:32:22] LOG_INFO [SendCartridgeInfo] :Responding to Message Method: 16
I have a Projet 1500. It's quite a lot older and different but I'm also interested in hacking it along with you. I wish it had a beaglebone It's a UV DMD printer running on Windows on a mini-ITX PC. The cartridge is RFID-tagged but I suspect not writeable : cartridge fill is measured with a load cell so refilling may be possible.
Looking to do this to my machine, Did anyone manage to decifer the method and have more specific instructions on the steps below? 1. Get root access to the machine 2. Download the binary and reverse engineer 3. Edit and save the binary back to machine Any help would be appreciated before I try.
I was able to use a different material and the printer seemed to ignore the fact that level was going up and down as I added and used material. But after a mess that jammed the nozzles open, the cartridge was emptied and it now reports as invalid after refilling. Perhaps it's only a zero level that gets recorded. Although my printer uses a different processor, I suspect the code is closely related. The logs are in a similar format and the Windows version is heavily parameterised - the beaglebone version may be just ported and use a very similar set of functions. Perhaps I could even replace my processor with a beaglebone. I would be very interested in obtaining a copy of the beaglebone code and setup files. Update : I was able to find an access to the RFID tag that read a negative value for remaining resin. Overriding this caused the printer to once again see the cart as valid and, after using some resin in a fill-tray operation, rewrite a positive value. The cart now works again and has subsequently been updated by adding more resin. This seems to suggest that it's OK to refill the carts as long as they don't get invalidated by being emptied (or possibly over-emptied). If that happens they can't be used : but it is possible to trick the printer into makingn them valid again.
hi which software can be used to deactivate the chip on the cartridge? or how do you get into the projet 1200 to deactivate this function of the cartridge monitoring. maybe someone can give me precise instructions. thanks in advance. grettings andrew
I don't have a Projet 1200. I have the Projet 1500 which uses a PC-based controller rather than a Beaglebone, and has a serial connection to the tag reader. However I understand from the comments above that you should replace the landerAppV binary with the one modified by memsos.
Hi how can i upload the landerapp? unfortunately i have no experience with beagleboards. where can i find this file? mfg andreas
It's attached to memsos' post at the start of this thread. The same file appears to be both in the firmware zip file in the first post and and the lander zip file in the second post. There are instructions on getting root on the beagleboard in the first post but you will need a little knowledge of Linux.
I would also need a guide because I don’t understand how to apply the hack. A tutorial would be nice. I would be willing to pay for it
Hello good night everyone, I am new to this from the projet 1200. A bad connection was made and I think my beaglebone burned out. Is there any way to get another beaglebone and go through the firmware. Thank you
1: download firmware_V1.0.53.0.zip landerV1.0.53.0.mod.zip; 2: extrct files from archive firmware_V1.0.53.0.zip replace file landerV1.0.53.0 with landerV1.0.53.0.mod<--- rename this file to "landerV1.0.53.0" , ( in archive there is 2 files named landerV1.0.53.0, one directly in archive another in LeanderApp floder, replace both of them with moded on) and archive all files in firmware_V1.0.53.0.zip 3: download and install Geomagic Print 1.2.7 4 : connect printer to pc with usb; turn off internet conection 5: upload modified firmware_V1.0.53.0.zip to printer using Geomagic Print, after printer reboots check cartrige if it shows as 100%; 6: upload original firmware_V1.0.53.0.zip( not modified) to printer after printer reboots check cartrige; i was able to reset cartrige at 100% by this way
