Dymo 550 Thermal Printer DRM Hacking

[Fara]

Have you got the pass through to work? I have a few dmo label rolls that I can use for the rfid if I can just find a way for pass through to work

My bluepill works only in a pass-through mode and I have the same rev I board.

To your previous question, as I understand, the EEPROM has a counter and it backs up the counter on the RFID chip. So you need to have both the pass-through mode and the writing protection enabled on EEPROM. Funny, it would stick to the number at which you put the WP mode. Better making it on a full roll. Mine now stuck at 20 labels left.

Regarding to the issue that you have, it is hard to debug by just looking at the printer's LED.
The counter is more or less independent from the chip validation. So if you don't have chip confirmed, you would not get to the counter.
I would suggest to return the status of the bluepill to the UART and maybe even dump the data from I2C to UART.

[AKRUA]

Would compiling my own binary possibly be beneficial to me rather than using a precompiled binary? Or would that not effect how the pass through works?

[Fara]

Would compiling my own binary possibly be beneficial to me rather than using a precompiled binary? Or would that not effect how the pass through works?

The pass-through mode turns on when a real tag is presented to the RFID reader. You don't need to recompile the code for that.

You would need to recompile only if you want to change the code (e.g. adding the UART logging).
There are different binaries available for different simulated tags. I don't remember what happens when you have a conflicting roll type in the binary and in your real tag. So make sure, the roll type/size is correct.

Also, make sure your real tag is close enough to the RFID reader. It should be within ~20 mm.

Also, I think the easiest part to screw up is the wiring. Make sure you have the right resistors and wiring.

Ah, another thing I noticed. The printer is blinking if anything is wrong. Including other cables. Make sure you have connected all the cables. Make sure the paper also has holes similar to the original and the paper is pushed forward.

[AKRUA]

I should mention, i am looking at the print queue in windows to see what the error state is, which is where im getting the "unknown label type" message

[sp7dpt]

@js_12345678_55AA Hi, I have a printer with a Rev. E board.
I programmed the Bluepill new release (v1.1.1):

freedmo-default-sku-S0722530: the label is detected
freedmo-default-sku-S0722560: the label is detected
freedmo-default-sku-S0722540: the label is not detected, but the LED in the printer does not blink. It shows a blank label with no counter. After manually selecting the label, printing is possible.
Other random labels are also not detected automatically.
Is there anything I can do about this?

[Axis-3790]

Is this thread dead now? I was really hoping we could get a resolution on the REV I board. I have 2 of them and I know others are have them as well. I am not sure of the process to looking into this but I am resourceful if anyone has any leads. I would love to contribute. I am just not sure where to start.

[Bastelwastl]

Hello everyone,

with the newer board revisions with large EEPROM, I discovered that every new label SKU that isn't yet stored in the EEPROM must be saved to the EEPROM once. Otherwise, the DMO will flash, and you'll get an error message in the program.
This means you have to disable the read-only-mode (remove the solder blob on the EEPROM, it's better here to solder in a switch , two wires that can be twisted together or similar).
Insert the unknown original label you want to learn to the DMO or the unknown SKU from the bluepill, turn on the DMO (DMO shouldn't blink with read-only disabled), print a test label, turn off the DMO, and switch back to read-only mode (solder blob or similar). This has to be done with every unknown SKU.

For those who new install the bluepill to their DMO, install first the bluepill with the choosen SKU, print one or two bluepill-emulated-labels, if this works then
enable/ switch on read-only-mode on the EEPROM, one step before the other results in a non working flashing DMO (if the label SKU is not in the EEPROM).

[kko]

It looks like that the Numbers after the Modelcode (QE=550,QF=550Turbo,QG=5XL) give no hint to the Revision, maybe its the Letter in the End ?

My suggestion:

QExxxxxB = Rev: H
QExxxxxD = Rev: K     

QExxxxxB == Rev K too
It depends on number inside i think

[kko]

Meanwhile I created a new release (v1.1.1 on Github) which should fix the pass through problem introduced with v1.1.0.
=> https://github.com/free-dmo/free-dmo-stm32/releases/tag/v1.1.1

Next few days I should have some more time to check everything with my 550 Rev. K.

JS

Is there any updates about LW550B_Rev. K (QE**********B)?
Anyone runs free-dmo on rev. K?

I am ready to pay for a working solution, maybe we can offer a donation to make it more interesting for everyone to do this? I have 300 US dollars at the start.

[haadeej]

Come on, let's get this stuff fixed. I am adding 300 US dollar as well.

[DeckelHead]

This is a little discouraging.  I finally got a printer and then got the DRM code.  I subsequently modified the code to add a simple command set through a UART with the intent of being able to update the label SKU being sent to the printer.  But what tripped me up is that the github site indicates that the connector is a JST-GH connector.  I bought that and, well, that isn't correct.  Then I found that Google AI says it is a Molex Microblade.  Nope... strike two!  Then I started search this thread and found that my Rev I might not even work anymore due to some apparent thwarting by the evil Dymo engineers.

So, my question is twofold.  First, does anyone know what type of connector is used on the Dymo 5XL printers (Rev I main board, Rev E NFC board)?  Second, is there any new information on making the DRM spoofer work in emulation mode?

<<UPDATE>>. I think that the answer to my second question is that the connector *may* be a Molex MX (not JST) connector.  Both the header and connector look very similar to pictures I've found of the MX....  TBD on this though

<<UPDATE #2>> I have confirmed that product entitled "1.25mm Pitch Connector Kit 2/3/4/5/6/7/8/9/10 Pin and Pre-Crimped Cables 15cm for JST Molex PicoBlade 1.25" on Amazon (link follows) will work for the connector on my 5XL.  I'm obviously retracting my comment (above) that this not the Microblade.  I found that the designs can be slightly different from various vendors, but measurements don't lie, and when I bought a Microblade connector it fit just fine.... The JST GH connector referenced in the github project did not fit.  It seems unlikely that they would use a different board for the 450 versus the 5XL, so my guess is that Dymo updated their design to the MX connector at some point.  So, carefully measure/review what you have on your system and purchase accordingly


Amazon link: https://www.amazon.com/dp/B0DR1S5981?ref=ppx_yo2ov_dt_b_fed_asin_title

Further developments:
I am currently working on updates to the github project.  These seem to be going fairly well right now.  The enhancements will support a serial interface that takes a set of commands.  With those commands you can list available SKUs, "load" a different sku, etc.  You will also be able to upload a new SKU (such as what people post here).  Due to the way the Blue Pill EEPROM works, there will be a limited number of SKUs that you can upload and then you will need to clear all uploaded SKUs (sorry).

The longer term idea is that I'll have a separate device, probably a Raspberry Pi, that hangs off the serial port and provides the commands.  The RasPi will have a web server and allow you to upload/modify SKUs remotely.  I may even see if I can add a print server to this so that you'd have a wireless 550/5XL.....

Let me know if there is any interest in this development work.

[wifikebab]

I have interest if you're adding support for later hardware revisions, since I have no idea where I would get the hardware revision used by others in the topic. 

[davvcio2]

I recently bought a Dymo 5XL and came across the free-dmo project on GitHub. I built my own bluepill, and only afterwards did I end up in the Issues section, where I learned that it no longer works.

Is anyone still working on this topic here, or should I just throw this product in the trash now?

[haadeej]

Added IL injection: https://github.com/free-dmo/free-dmo-stm32/pull/59/

[haadeej]

Added prototype custom firmware. Needs some hardware fieldwork: https://github.com/haadeej084/free-dmo-stm32/tree/main/OpenDMOfw

Anyone able to help?

[haadeej]

Managed to sniff serveral write passwords. Is there even anyone still interested in getting FreeDMO going again? Seems awfully quiet here last couple months. I reckon I will just keep it to myself if nobody cares.

[PlainName]

I don't use it because I won't by any Dymo stuff now, because of this DRM farce, but I think it would be useful to have your project available for those that come along next year looking for a solution, perhaps. Not everyone interested will be here now or even a normal reader of the forums. There could even be some forum member that hasn't yet discovered this thread!

For reference, look at the Agilent DSOX2K thread, where pretty much anyone that had one has moved on years ago. But 0 posters are still turning up and using it as a reference, and to get the hacks working.

Personally, I appreciate what you are trying even though I won't benefit