Dymo 550 Thermal Printer DRM Hacking

[sleemanj]

FYI, amazon said on twitter they would do something about it and a few hours later a ton of old reviews have been removed.

Probably only from that specific listing you had, where as this was the first one I got when googling for "amazon labelwriter 550" and has 7.4k reviews dating back years.

https://www.amazon.com/DYMO-Label-Printer-LabelWriter-Thermal/dp/B08TLRL392/ref=cm_cr_arp_d_product_top?ie=UTF8&th=1

[GopherT]

Looks like someone was fired over this...
Demo is looking for a new Product Manager/Brand Manager.

https://careers.newellbrands.com/us/en/job/2200802/Product-Manager-Brand-Manager-DYMO

[ygi]

Looks like someone was fired over this...
Demo is looking for a new Product Manager/Brand Manager.

https://careers.newellbrands.com/us/en/job/2200802/Product-Manager-Brand-Manager-DYMO

If someone got fired/quit it had to be because they were the one person in the company opposed to that stupid cash grab. No corporate drone's ever been fired for being too greedy on behalf of their employer.

[DynoDrmBeGone]

Just noticed something and hope it might help in figuring a way to defeat this insane DRM protection...
When I'm printing labels from my MacBook pro M1 it tends to print an empty lable after the original print... However if u unplug the USB cable from my Mac directly after the first lable is done printing, the empty lable isn't generated, but even better if I cancel the print job without the USB cable and reconnect the printer the lable count isn't decremented so you can print without decreasing or incrementing the nfc counter and it will still accept to print the next lable afterwards... I now have an empty roll wit 32 prints left

[mikeselectricstuff]

If there is a significant delay between it reading and writing the RFID tag, maybe a possible approach is to jam the signal with an external (modulated) 13.56MHz source to block the write.

[DynoDrmBeGone]

Wouldn't it theoretically be possible to create a write locked NFC tag, with the expected Dymo data on to it? Than the printer can do it's roll type detection, thinks it's already used for some prints so it doesn't have to do any initialisation (if it even does that on the first print) and simple can't decremented the counter?

[apelly]

Demo is looking for a new Product Manager/Brand Manager.

https://careers.newellbrands.com/us/en/job/2200802/Product-Manager-Brand-Manager-DYMO

From that page:

Join us and benefit from:

    4Ts Values: Truth, Transparency, Teamwork, Trust
    Corporate Citizenship Philosophies – environmentally sustainable and socially sensitive business practices.

[js_12345678_55AA]

Looks like all those Arduino libraries do not support I2C slave very well 

I tried ESP32, STM32 (we need a 3.3V MCU).

Next best thing would be to use native STM32 for emulation (stm32 blue pill boards seem to be available everywhere, even boards with cloned STM32 should work)

JS

BTW: The mentioned "CY8CKIT" Infineon IC / board is expensive and ICs are not available as far as I can see. Any particular reason why this was suggested?

[mistial_dev]

BTW: The mentioned "CY8CKIT" Infineon IC / board is expensive and ICs are not available as far as I can see. Any particular reason why this was suggested?

The cy8ckit-059 has apparently had a price increase.

They used to be $10, which was a great value for the chips you get with it.  Looks like infineon has hiked things a bit.

https://www.reddit.com/r/PSoC/comments/360r4p/10_for_cy8ckit059_has_cypress_psoc_5lp_target/

They still have some really nice i2c support, though, and it is very easy to work with.

https://www.infineon.com/dgdl/Infineon-Component_I2C_V3.30-Software+Module+Datasheets-v03_05-EN.pdf?fileId=8ac78c8c7d0d8da4017d0e9599661ff4

The biggest advantage with cypress is that as long as you are doing something that's officially supported, the libraries/tools/etc. you need are all first party, and tend to be fairly top notch.

The disadvantage is when you want to go beyond what's officially supported.  The tooling stops helping you and starts fighting you.

[js_12345678_55AA]

I decided to use a STM32F103 since they are (still) available for reasonable prices from various sources. Anything like a "blue pill" will work.

And..... IT IS WORKING! 

Full emulation of the reader IC + tag as a standard CubeMX project.
Whenever the roll is changed or the printer enters power down mode the counter is "REFRESHED"

Next step... I additionally interface the original reader so change of paper types is easy (just hold a tag of the paper type you want to use to the side of the printer and the emulator will "LEARN" it).


JS

[mistial_dev]

That’s smarter than what I was planning.

If you are planning on releasing, I’ll stop working on mine.

[mikeselectricstuff]

Next step... I additionally interface the original reader so change of paper types is easy (just hold a tag of the paper type you want to use to the side of the printer and the emulator will "LEARN" it).

...but that assumes you've already bought some of the original expensive labels...

[mistial_dev]

Or have cloned the tag to a card.

[Bud]

That’s smarter than what I was planning.

If you are planning on releasing, I’ll stop working on mine.

Please do not, we need diversity. 

[EEVblog]

I decided to use a STM32F103 since they are (still) available for reasonable prices from various sources. Anything like a "blue pill" will work.

And..... IT IS WORKING! 

Full emulation of the reader IC + tag as a standard CubeMX project.
Whenever the roll is changed or the printer enters power down mode the counter is "REFRESHED"

Next step... I additionally interface the original reader so change of paper types is easy (just hold a tag of the paper type you want to use to the side of the printer and the emulator will "LEARN" it).

 

A DIP switch maybe?
Most people stick with the same roll in the sme machine all the time, and there are mostly only a coulple of major label sizes people use.

[js_12345678_55AA]

Thanks for the suggestions...

The emulation contains "learned" labels already, and if you use it like I do (multiple rolls per day all of the same type) then this is just enough.

Switching between rolls can be done using either another original roll (which is then learned) or by using a simple of the shelf NDEF Tag where you just write the SKU of the roll (e.g. "S0722430") inside (like you do with business card information, any phone can do this nowadays).
So by presenting either an original roll the complete data is learned, or by presenting a normal RFID NDEF tag with the SKU inside to choose from the pre installed tags is enough to switch between rolls.
This makes it possible to modify the printer once and then no need to open again in order to switch roll types.

Meanwhile I also created a small Android app which can be used to dump the complete SLIX2 tag (including the "signature" data).

I will setup a github project in the next few days with all the sources.
(As soon as github outtage is over: https://www.githubstatus.com )


On the other hand I learned about a very beautiful (and available) NXP IC today. A friend suggested to have a look at the NHS3100 IC.
https://www.nxp.com/docs/en/data-sheet/NHS3100.pdf

Ignore the "temperature logging" in the title... and have a look at chapter "8.10 RFID/NFC communication unit"
This IC is a CortexM0 which can speak the correct NFC protocol...
This makes it possible to completely emulate a SLIX2 tag with a "magic counter":

The IC is (including inflated pricing) $4:
https://www.digikey.com/en/products/detail/nxp-usa-inc/NHS3100-A1Z/6578221

A completely working development board (which should be usable as magic tag) is availbale for $60 (Will pay itself after using only 4 off-brand rolls )
https://www.digikey.com/en/products/detail/nxp-usa-inc/NHS3100TEMODBUL/6578223

And I really like the idea to fight NXP with NXP 

Looks like the UID is fixed so this can not be used 

JS

[js_12345678_55AA]

The first release is an Android utility application which can be used to dump the complete content of SLIX2 tags:

https://github.com/free-dmo/free-dmo-tag-dump

You just start the app, hold it near the paper roll to scan it and it will show the complete dump.
It also will create a text file per dump in the "Downloads" folder.

It comes with full source code but also contains a pre compiled APK for "lazy" people (BUT: You really should NEVER EVER download APKs from somewhere and install them to your main Android device... Go the extra mile and check the source then compile it yourself!).

@ALL: It would be nice if you could use the app to scan some of your rolls (doesn't matter if consumed or fresh). Please copy/paste the content of the text file and post them here.


The difference of the raw dump compared to the output of other NFC apps is that it contains extra information like the Originality Signature from SLIX2 tags (which we need for a complete emulation).

JS

Attached are my 2 rolls. One is the small roll which comes with the printer the other one is SKU "S0722430" (54mm x 101mm |  2 1/8 x 4 inch)

EDIT: One more roll attached.

Anybody else please?

[js_12345678_55AA]

It's done...

https://github.com/free-dmo/free-dmo-stm32

- full emulation for "endless" printing
- optional pass through of original RFID tag data (only the counter will be emulated)

JS

[mistial_dev]

Please do not, we need diversity. 

Plenty of things to hack out there.  I can do something else

[mistial_dev]

Here ya go.  4x6 inch, or 104x159mm.  Standard shipping size.

[SkullKill]

#FREEDMO GETS RID OF DYMO LABEL PRINTER DRM

https://hackaday.com/2022/03/30/freedmo-gets-rid-of-dymo-label-printer-drm/

https://github.com/free-dmo/free-dmo-stm32

[tooki]

#FREEDMO GETS RID OF DYMO LABEL PRINTER DRM

https://hackaday.com/2022/03/30/freedmo-gets-rid-of-dymo-label-printer-drm/

https://github.com/free-dmo/free-dmo-stm32

Yyyyyeah, we know, since the developer of that is a forum member and documented his progress in this thread.

[SaltyDog]

Can someone please dump a 1x1" tag? I will dump mine, when it comes in, and if no one posts.

[EEVblog]

Louis did a follow-up, and I agree. The hack, whilst  worthy isn't going to make a difference I'm afraid.
Those that have the motiviation/ability to do the hardware hack are those who have the motivation never to use Dymo again for this. Almost all business customers will just continue to buy the genuine Dymo labels.
We need to hit Dymo hard now or every other manufacturer will see that they succeeded and they will try the same thing. We do this buy having an active anti-Dymo campaign and refusing to use their products and buying their competitors (I recommend Zebra). Keeping on top of the fake Amazon reviews and the like etc and help grow the new organic 1 star reviews. Eventually it has to hit Dymo where it hurts.

[EEVblog]

And for those that want an alternative to the Dymo label software, and have support for countless printers including the old Dymos, I've been talking to the author of this software:
https://label.live/
He's also close to releasing his own printer as well.