[xssfox] recently found a Cricut Maker in an e-waste disposal. A quick scan over the device indicated it was in moderately good condition, with merely some perished rollers to contend with. The device was salvaged, with the awareness that Cricut is plenty good at disabling and locking down machines when it wishes. However, those measures didn’t stop [xssfox] from bringing it back to life.
The suspicion was that the machine had been locked out after the original owner received a warranty replacement or similar. Whatever the reason, the rollers would have to be repaired and the machine unlocked if it were ever to cut (Cricut?) again. Hooking the machine up to Cricut software showed that it was “deactivated”, so there was work to do.
The rollers were not a difficult replacement, but the hacking would take a little work. Examining the motherboard didn’t reveal any obvious EEPROMs, and the microcontroller was not one [xssfox] had the debugger to work with. Thus, attention turned to intercepting communications between the machine and the host PC over USB. This revealed the machine sending its serial number to the Cricut PC software in plain text with no checksums or encryption at all. Unlocking the machine was as easy as installing an RP2040 in between the Cricut Maker and the host PC. It was programmed to relay packets between the two and spoof the serial number in the process.
[xssfox] suspects a software-only solution may be possible, too, though hasn’t implemented one yet. We’ve featured her work before, too, like her efforts to spoof emergency traffic light preemption signals.
Surely even windows has some sort of way to create a virtual serial device, and then one just sits a little program between the real and the virtual, no? Although one could argue the hardware solution is a bit more portable.
There are a variety of 3rd party tools for assorted virtual COM port shenanigans. I definitely haven’t done a systematic survey; but I’ve mostly encountered them as part of (usually kind of dodgy) vendor software support packages for oddball industrial and scientific equipment and utilities where serial-over-LAN is being bodged into a setup that is only aware of physical serial ports or some other peculiar configuration.
I suspect that, in practice, there’s just less interest in windows among the sorts of people who write utilities of that flavor, so the ones that aren’t obscure commercial products are more likely to end up on Linux; and the driver signing requirements of contemporary windows are a bit of a barrier for anything where you do need a kernel driver for something.
It’s not elegant from the perspective of a late-70s silicon-is-expensive-heroic-part-count-reduction situation; but for what a quite capable low-ish speed MCU doesn’t cost I suspect that a little line lump that provides a standalone, OS-agnostic, fix is very much the more sensible approach.
Driver signing requirements, plus complexity of kernel mode development & distinct complexity/lack of up-to-date education on the subject, is not helping :(
This is missing the real issue, that manufacturers of products like this are simultaneously interested in keeping them as proprietary as possible and in keeping development costs as low as possible. This results in terrible software, firmware and drivers and next to no end just support.
The vast majority of devices do not need complex drivers to function, in many cases a bog standard serial over usb is all that is really needed, but as in this case, the vendor is handling warranty claims by locking old hardware rather than even bothering to refurbish.
This tells you that the majority of the cost is essentially licensing.
I wonder if something as simple as doing a find and replace using a ram editor might do the trick.
If the serial is sent over USB in plain text, perhaps it’s in the software in plain text too, it might be easy to find, instead of spoofing the serial number, simply changing a couple of bytes might well patch it to always jump over that check.
The trick is preventing the vendor from immediately bricking the hardware after you’ve done this, and the solution is not using their always online tools and graphics library.
Is there a way to avoid using the cricut design studio? I haven’t found anything. I hate it and I would switch in a heartbeat but it seems like we’re all locked in
In the conclusion: “[xssfox] suspects a software-only solution may be possible, too, though hasn’t implemented one yet.”
And yeah, that should be doable even on windows
This is one reason not to buy Cricut branded products.
I was tempted until I saw their control over a product I was supposedly “buying”
How about fixing printer ink id on ink cartridges?… anyone have one
A few years ago, I almost bought one, I was planning to use it to cut PCB traces into copper clad board, something about making circuits with a cricut seemed amusing to me. At that point the price put me off. After seeing this sort of corporate evil was part of their business model, I’m quite glad I didn’t bother.
Do you know of any sensible alternative?
My library uses Brother Scan’n’cuts and they seem to be more capable and less locked in.
These things are essentially inkjet printers with a pen/cutting wheel in place of the Ink cartridges. I guess, at least from a hardware perspective, a retrofit on a cheap printer wouldn’t be too difficult. At at least a fifth of the cost of a cricut, it could make for an interesting project.
I see a fair bit of information on the web about converting a 3D printer to a vinyl cutter. Cheap drag knives and open source software along with the price of old Ender 3’s from various sources make this a pretty appealing proposition.
I got a second-hand Cricut Explore plotter/cutter a few days ago; it’s an old model, paid peanuts for it. As the price was VERY convincing, I never bothered checking Cricut background, thinking it would probably be like Brother or Sillhouette…
…just to find out that the sw is completely proprietary (and horrible), windows-only, communication is encrypted via serial ACM, and every single project trying to port it to linux is shut down by Cricut. The machine itself is great, nevertheless.
That said, challenge accepted.
I also got a good deal on a used Explore, and I’ve been hoping someone would pick up the gauntlet. Besides being a proprietary cash grab, the software is horrid.
Sadly we are still missing an alternative firmware & PC program for these machines
I’m seriously considering using AI to attack this problem. The proprietary nature of Cricut is an absolute nuisance.
I have one sitting behind me and I have used it to draw on PCBs, but the software workflow is a pain and not entirely reliable because it isn’t intended for it.
I’d be interested in seeing your results. My wife bought one of these several years ago and got a lot of good work from it. Unfortunately, they have gradually locked down more and more functionality so that it will now only accomplish the most basic functions without some sort of subscription.
It uses AES-ECB (plot a circle in the sw, intercept the traffic and you will see many encrypted packets that match others)
Two options exist:
1. Obtain the aes-ecb key, which may run afoul of laws, and could likely be changed via fw update.
2. Determine which encoded packets translate to which functions. Likely ok legally, but again an update breaks it.
Not an issue for my jurisdiction. Thankfully.
Highly doubt or that key would already be in the wild and alt software would exist (it did at one point but were sued out of existence), and given the remark “I’ll throw AI at it” I also doubt you have the skills to get it or do anything once you did.
Feel free to prove me wrong, you would likely get an article here and thousands of stars or whatever the code repo has (MS would take it down immediately).
Thank you for expressing your doubts about my skills, rather than discussion around the required complexity.
For the record, I used to crack video games for fun; that time has come and gone, but I think perhaps you might see how those skills are related. Or not, you probably think I just ran a script provided by the community.
I admit having 30 years of experience doing low level debugging, memory tracing, protocol development and embedded development is hard to perceive from a few sentences on hackaday comment.
In this case this project would simply be more fun shoving it at an AI and seeing if I can cajole it to do the work. I barely use the cricut because it was such a nuisance in the past. (The software caused issues with accuracy so I largely ditched it from my process flow.)
Those are the types of laws that spark civil disobedience.
https://github.com/XtremeCoder007/slicebug ;)
Please do, the community would be thankful.
Indeed, just tell Claude to build it with no mistakes and then drop the source online anonymously
Source code? Github?
If you read the linked article you’ll see that the person isn’t sharing the source due to potential legal issues. But they do hint that it’s close to some existing samples already available in the Arduino editor.
There’s always the option of cutting out the middle man, trading in the cricut’s brain for an Arduino / RasPi. Perhaps cutting traces and reusing motor drivers etc.
Considering it’s a lowest bidder design it should be pretty easy.
Someone is about to get a C&D from Cricut®
Cricut honors a warranty by replacing a non-functional device.
Cricut disables the non-functional device (they now own), so that people don’t take advantage of their warranty program.
Here is a review from Cricut’s OLD warranty returns method:
“I have to first contact them to get a shipping tag, then I have to BUY a box if I don’t still have the one it came in. Then I have to wait for it to get shipped there. Then wait for them to evaluate. All which takes two MONTHS! Only after all that time do they then send me a replacement.”
This new returns method (remote deactivation) eliminates returning the old broken device. This is what their customers want. They care more about low-cost and fast returns. Consumers that want a more repairable, rugged device and don’t like the idea of ewaste, well they purchase the more expensive Starcraft/Siser/Silhouette/etc.
Here Xssfox finds a way to repair the non-functioning unit by using the serial number of someone else’s functional cutter. This likely screws over the owner of the random serial number he’s using. Xssfox gives zero cares because Xssfox is a rebel.
Ah. Spoofing means using someone else’s active serial number.
I assumed that must be the case but didn’t catch that specific detail in the article.
Not cool if it causes problems for the legitimate “owner” of the functional serial number.
So, does this mean that the device reaches out to the cloud upon use? Or, how did the software know to shun the wounded unit?
Probably should watch the video…
Some of it is described in the article. The software reads the serial, checks for it, and if it is disbled , refuses to work with the printer. What she did was masquerade the printer as someone´s printer, so if something wrong goes in the software, the other person printer will stop working. Not very nice, and these could be considered more of a security bug on the cricut framework than a “unlock” mechanism.
Printers check for firmware updates by telling the servers their model, serial number, etc. If a device is scheduled to be deactivated, it gets served an ‘update’ that is just firmware that bricks it.
While trying to determine how this all worked, Xssfox possibly bricked numerous printers.
It’s hideously irresponsible of cricut to create e-waste the way they do.
For anyone trying to use a Cricut device without the internet connected software, https://github.com/XtremeCoder007/slicebug works great. You do need an older version of the cricutdevice.exe, but that’s not hard to find.
so i’ve been working on the firmware for personal and expression original versions… it’s probably ready to publish.. i started with the freeexpression firmware and made it super awesome with full machine control, no cloud, no cricut control. and some grbl compatibility. if someone wanted to check it out, you just need an esp32 with a few jumper wires to the j5 connector. lmk if anyone wants to check it out!
… Yes please.
Ffs, there we go
And nope
Of course we want to see it.
Someone (with more skills than me) really needs to make some kind of open board replacement for these devices if possible. I certainly would buy one!
Cricut support tried replacing my one year old, twice used Maker 3 with a refurbished unit because of a SOFTWARE problem regarding one file in the profile folder that their software creates. While the reply worked on ordering the replacement i declined I worked out which file was causing the problem and showed her (removed into my pc). Yeah, like 3 weeks later a new version of Cricut Design Space was released.