Dymo 550 Thermal Printer DRM Hacking

[Darxtek]

So it looks like I got everything programs correctly and I’m using 4 x 6 labels if I were to want to change label size what would I need to do flash different  .bin or leave it as is?

[czester1994]

Label 1/2"x1" S0722530. Please compile for .bin file. Thanks

[Mhare]

Hi all,

I’m new to programming never done this before. I have soldered all the wires on but I’m stuck with downloading and installing the firmware. Any help would be great thank you

[Iomega0318]

Long story short, I work for a school and we've been using the 450s for years with the software we use and 3rd party labels. However we have had 450s failing frequently and started replacing them with all that is available now the 550s, the software update our provider has pushed out is also no longer going to support the 450s, neither Dymo or the other company will admit to this, so we're being forced onto the 550s. Our 58+ schools that have 2-3 dymos each pay for their own labels hence the 3rd party.

I have successfully soldered and programmed a board with our labels, I'll provide the dumps once I get it fully working, but have run into a weird issue. When you first power on the Dymo it doesn't recognize the board (no RFID) and therfore says no label detected, power it off from the front and back on and it works, power off and on from front no work, power off and on from front again works. It seems to be consistent that it only works ever other power cycle, green light blinks correctly when it's working as well. Any ideas?

[Iomega0318]

Hi all,

I’m new to programming never done this before. I have soldered all the wires on but I’m stuck with downloading and installing the firmware. Any help would be great thank you

Where are you stuck, what have you tried?

[allenlorenz]

 Here is the dump for the dymo 30333 tag

[imintune]

Is there a place or someone I can just ship this 550 to get it done?

[RethoricalCheese]

Hey!

Looks like there has been a modification in firmware which blocks this hack.
Mainboard and NFC reader are exactly the same. Bluepill works on printer with lower serial number and doesn't detect anything on higher SN. Same exact module works on all older printers and none of the newer ones.
Just to be 100% sure that there are no hardware differences, I transferred microprocessors between both printers. The issue transferred aswell so it's 100% firmware difference.


Used a logic analyzer to dump startup on both printers (with original wire and nfc module, no bluepill between them. Same roll on both of em).

Here's the diff between them: https://www.diffchecker.com/5YVaDYkI/

Kindla looks like signature is read twice and expects this:
uint8_t signaturecmd[] = {0x22,0xAB,0x04,uid[0],uid[1],uid[2],uid[3],uid[4],uid[5],uid[6],uid[7]};
and then this:
uint8_t signaturecmd[] = {0x22,0xBD,0x04,uid[0],uid[1],uid[2],uid[3],uid[4],uid[5],uid[6],uid[7]};
but current version of freedmo only transfers the latter.

I might be way off tho..

[js_12345678_55AA]

Hey!

Looks like there has been a modification in firmware which blocks this hack.
Mainboard and NFC reader are exactly the same. Bluepill works on printer with lower serial number and doesn't detect anything on higher SN. Same exact module works on all older printers and none of the newer ones.
Just to be 100% sure that there are no hardware differences, I transferred microprocessors between both printers. The issue transferred aswell so it's 100% firmware difference.


Used a logic analyzer to dump startup on both printers (with original wire and nfc module, no bluepill between them. Same roll on both of em).

Here's the diff between them: https://www.diffchecker.com/5YVaDYkI/

Kindla looks like signature is read twice and expects this:
uint8_t signaturecmd[] = {0x22,0xAB,0x04,uid[0],uid[1],uid[2],uid[3],uid[4],uid[5],uid[6],uid[7]};
and then this:
uint8_t signaturecmd[] = {0x22,0xBD,0x04,uid[0],uid[1],uid[2],uid[3],uid[4],uid[5],uid[6],uid[7]};
but current version of freedmo only transfers the latter.

I might be way off tho..

Looks like they added another command "0xAB" to also read the "NXP_SYSTEM_INFORMATION" (see https://www.nxp.com/docs/en/data-sheet/SL2S2602.pdf  "9.5.3.18 GET NXP SYSTEM INFOMATION", page 33)

The content from this request will be static for all tags so a simple emulation should do the trick.

As soon as I find some time I will try to add it.
But testing needs to be done by you since I do not have (and do not plan to buy) an "updated" DMO550.

JS

[RethoricalCheese]

Ofcourse, happy to test.

[js_12345678_55AA]

Ofcourse, happy to test.

Here we go. Since you made such a nice diff (SERIOUSLY REALLY HELPFUL!), I assume you know how to check out a branch and compile the firmware yourself.

See: https://github.com/free-dmo/free-dmo-stm32/tree/feature/nxp_system_infomation  (the missing "r" in information was adpoted from original NXP document  )

If this works, I will merge this as well as some long-standing pull requests 

JS

[RethoricalCheese]

Good new and bad news.

It works on older SN models.

It kinda works on newer SN models. It does detect emulated roll now.
But the issue is that it remembers. Number of labels decrease and do not reset after a power cycle. Not even when testing on another PC.

But wait, there is more. Just turning it off and on, it is unable to connect to PC. Only after capacitor discharge, it is able to connect again. But this issue is not because of freedmo. It's acting like this in stock aswell.

Tested on 2 devices.