Spoofed Serial Number Unlocks Cricut Machine

[xssfox] recently found a Cricut Maker in an e-waste disposal. A quick scan over the device indicated it was in moderately good condition, with merely some perished rollers to contend with. The device was salvaged, with the awareness that Cricut is plenty good at disabling and locking down machines when it wishes. However, those measures didn’t stop [xssfox] from bringing it back to life.

The suspicion was that the machine had been locked out after the original owner received a warranty replacement or similar. Whatever the reason, the rollers would have to be repaired and the machine unlocked if it were ever to cut (Cricut?) again. Hooking the machine up to Cricut software showed that it was “deactivated”, so there was work to do.

The rollers were not a difficult replacement, but the hacking would take a little work. Examining the motherboard didn’t reveal any obvious EEPROMs, and the microcontroller was not one [xssfox] had the debugger to work with. Thus, attention turned to intercepting communications between the machine and the host PC over USB. This revealed the machine sending its serial number to the Cricut PC software in plain text with no checksums or encryption at all. Unlocking the machine was as easy as installing an RP2040 in between the Cricut Maker and the host PC. It was programmed to relay packets between the two and spoof the serial number in the process.

[xssfox] suspects a software-only solution may be possible, too, though hasn’t implemented one yet. We’ve featured her work before, too, like her efforts to spoof emergency traffic light preemption signals.

Simple DIY STM32 Oscilloscope Project

In part one of what is intended to be a series on developing an STM32-based oscilloscope, [BTTLab] demonstrates a how to use the built-in ADC of an STM32F207 MCU to develop a straightforward single-channel oscilloscope. This can be followed along both via the YouTube video and the GitHub repository for this single-channel version.

Oscilloscope front-end protections. You want this. (Credit: BTTLab, YouTube)
Oscilloscope front-end protections. You want this.

Of course, an MCU’s ADC generally won’t hold a candle to a dedicated ADC for oscilloscope purposes – along with the typical beefy FPGA-based processing – with even a basic Rigol DS1054Z hitting a cool 1 GSPS, but the 2 MSPS at 12-bit resolution achieved by an STM32F207 isn’t shabby either. For more basic, low-frequency circuit and protocol debugging it would already be enough.

One thing briefly touched upon in the video is the front-end. The ADC’s inputs are rated for a specific voltage range, typically 0 to 3.3 V when running the MCU off 3.3 V, so you do not want to put higher or negative voltages into said ADC input. This is where measuring something like AC becomes rather tricky and you can get some exciting releases of magic smoke.

The demonstrated single-channel oscilloscope firmware uses the ST HAL, so it might be somewhat easy to target other STM32 MCUs as well, though naturally ADC performance will differ per MCU family and sometimes sub-family, so make sure to read the datasheet and programming manual before you dive in too deep.

Continue reading “Simple DIY STM32 Oscilloscope Project”

Tearing Down A Cheap Digital Caliper

Most hackers and makers end up with a cheap pair of calipers in the toolbox at some point or another. [DiodeGoneWild] decided to take a particularly cheap plastic pair and tear them down to see what makes them tick measure.

The electronics is, unsurprisingly, all contained inside the carriage which slides along the ruler. The ruler itself has an etched copper strip inside, underneath the scale sticker, with repetitive T-shaped sections. Meanwhile, the PCB in the carriage has a series of plates for capactive sensing. As the carriage slides along the copper strip inside the ruler, the capacitive sensing plates pick up varying capacitances which are directly proportional to how far the carriage has moved, allowing for precise measurement of relative position. Zeroing is a job for the user, via the ZERO button. We get to see how this works on the bare hardware level, and [DiodeGoneWild] even breaks out the oscilloscope to help show us what’s going on.

[DiodeGoneWild] also notes that these calipers are particularly frustrating for how quickly they discharge batteries while in storage. This may be down to the convenience feature, wherein moving the caliper switches the display on. There’s no hard off switch here—so the caliper is always drawing some juice even when it’s just in the cupboard. This is why these things are forever turning up dead when you need them.

If you’ve never pulled apart one of these cheap tools, this is a great way to see what’s actually going on under the hood. We’ve seen some other great teardowns lately, like this deep dive into a cheap pair of smartglasses. Video after the break.

Continue reading “Tearing Down A Cheap Digital Caliper”

CNC’d, CNC-inspired Adjustable Wrench Won’t Round Your Bolts

We’ve probably all got one item in our toolboxes or chests that we really, really don’t like, but find too handy to toss. For [Someone Should Make That], that item was the bolt-rounding adjustable wrench. Rather than continuing to gripe about it, or alter his habits to make greater use of the full wrench set he also owns, he decided to build a better mousetrap. By mousetrap, we mean adjustable wrench.

It took a couple of iterations on-screen before he hits on a solution that seems to work quite well indeed. The problem [Someone] had with his adjustable wrench was one of physical slop: once adjusted, there’s just too much play in the mechanism, which results in rounded-off bolt heads. [Someone]’s CNC’d solution takes inspiration from the CNC machine that manufactures it: he’s using spring-loading in the adjustment screw akin to what you find in the anti-backlash nut on your CNC mill or 3D printer’s ball threads. The tension from the springs keeps the wrench tight to the bolt, and that keeps [Someone] from rounding them off. Speaking of 3D printers, he prototyped in plastic before machining, and the screw in the end product stayed that way. It would be interesting to see how well that holds up.

Not only do we appreciate that it’s solved a common problem many of us have, the ethos of “this angers me, so I shall hack it” is one we support 100%, so do give a watch unless you’re one of those people who absolutely can’t stand videos, even when they’re spring-loaded to have no slop. There’s some good tips for beginner CNC operators in there, too.

This isn’t the first time someone’s tried to reinvent this particular wheel, though the last version we liked was a ratchet.

Continue reading “CNC’d, CNC-inspired Adjustable Wrench Won’t Round Your Bolts”

UV Printer? 3D Printer? HeyGears Says “Why Not Both”?

There’s a new contender in the prosumer UV printer world up on Kickstarter, the HeyGears G1. This one’s particularly interesting as they’re explicitly marketing it as being able to produce full-color 3D prints along with the “print-on-anything” functionality we’ve come to expect from a UV flatbed printer.

You get two choices of bed, with the larger being 420 mm x 320 mm x 130 mm. Hardly the largest build volume we’ve seen around here. You can fill that with up to 6 KG of UV ink/resin from its Epson-brand head in glorious full color and layers as small as 10 um. The ink isn’t super cheap — the CMYK kit looks to MRSP at 189 USD — but you aren’t locked in to expensive cartridges at least. HayGears sells ink in bottles, and you’re free to grab any other brand’s bottles if you want to risk it.

The Kickstarter is ongoing, and it will be some time before backers get their printers. But we can report that the early review copies, like the one [Steve Makes Everything] got for the video embedded below, seem to live up to the manufacturer’s claims, which is promising indeed. Certainly the idea of SLA quality without the mess is very appealing to many — though the super-early-bird price of two grand on Kickstarter and the doubtless higher MRSP may temper some of that interest.

If you’re curious about this UV printer business and why a maker might want one that doesn’t do 3D, our own [Tom Nardi] went hands-on with the EufyMake E1 last year.

Continue reading “UV Printer? 3D Printer? HeyGears Says “Why Not Both”?”

Hacking A Commercial Colorimeter To Add RAL Color Code Support

When you need to match paint colors, one of the tools you’ll reach for is a deck of reference colors. Another might be a colorimeter. But what if you want both? [hallko1234] created just that by reverse-engineering and then patching a CR4501 colorimeter.

It starts with a problem: every time [hallko1234] needed to check a color, he had to take a reading, write it down, run to the office, match it with a table, and then walk all the way back. That sounds like too much effort. The natural solution, of course, is to automate the process.

So he did. The CR4501 will happily give you its entire firmware over the debug port, after which it was time for analysis in Ghidra. Some hiccups, brickings and accidental erasure of calibration data later, he finally had a working version. The end result is a simple screen that, after every time you measure, displays the closest RAL color code and how close it is.

On the off chance someone else has the same colorimeter, he even made an online tool to install it for you.

Wireless LCD Streaming For The ANENG AN870 Multimeter

Having the information shown on the display of a digital multimeter also recorded off-screen can be incredibly useful, but unless the device exposes something like SCPI on a network interface, you will have to get creative. In the case of the budget ANENG AN870 digital multimeter (DMM), [Bits und Bolts] really wanted to show its display clearly as an overlay in OBS instead of just the camera view, but with said DMM not offering an easy way he had to resort to just copying the data sent to its multiplexed LCD.

The GitHub project page contains the background information, as well as the instructions if you too have this DMM. It might of course also be useful as the jumping off point for your own DMM modification. In total the project requires three modules: an RP2040 Zero and HC-12 433 MHz transceiver on the DMM side, and another HC-12 plus ESP32-C3 module on the receiving side. A boost module is also added to generate 3.3 V out of the 2.4 V – 3 V provided by the meter’s two AA cells.

To be able to read the LCD signal lines, a custom PCB was created that is installed inside the DMM. With the LCD’s segments mapped, this meant being able to send a perfect copy of the display’s state to the ESP32-C3 and from there making it available via WiFi.

Continue reading “Wireless LCD Streaming For The ANENG AN870 Multimeter”