Spoofed Serial Number Unlocks Cricut Machine

August 21, 2026 by Zoe Skyforest 48 Comments

[xssfox] recently found a Cricut Maker in an e-waste disposal. A quick scan over the device indicated it was in moderately good condition, with merely some perished rollers to contend with. The device was salvaged, with the awareness that Cricut is plenty good at disabling and locking down machines when it wishes. However, those measures didn’t stop [xssfox] from bringing it back to life.

The suspicion was that the machine had been locked out after the original owner received a warranty replacement or similar. Whatever the reason, the rollers would have to be repaired and the machine unlocked if it were ever to cut (Cricut?) again. Hooking the machine up to Cricut software showed that it was “deactivated”, so there was work to do.

The rollers were not a difficult replacement, but the hacking would take a little work. Examining the motherboard didn’t reveal any obvious EEPROMs, and the microcontroller was not one [xssfox] had the debugger to work with. Thus, attention turned to intercepting communications between the machine and the host PC over USB. This revealed the machine sending its serial number to the Cricut PC software in plain text with no checksums or encryption at all. Unlocking the machine was as easy as installing an RP2040 in between the Cricut Maker and the host PC. It was programmed to relay packets between the two and spoof the serial number in the process.

[xssfox] suspects a software-only solution may be possible, too, though hasn’t implemented one yet. We’ve featured her work before, too, like her efforts to spoof emergency traffic light preemption signals.

A long, rectangular electronic device is shown in front of a book of colour swatches. A small LCD display on the electronic device says “PANTONE 3005 C,” with additional color information given in smaller font below this.

A Spectrophotometer Jailbreak To Resolve Colorful Disputes

July 19, 2025 by Aaron Beckendorf 22 Comments

The human eye’s color perception is notoriously variable (see, for example, the famous dress), which makes it difficult to standardize colors. This is where spectrophotometers come in: they measure colors reliably and repeatably, and can match them against a library of standard colors. Unfortunately, they tend to be expensive, so when Hackaday’s own [Adam Zeloof] ran across two astonishingly cheap X-Rite/Pantone RM200 spectrophotometers on eBay, he took the chance that they might still be working.

They did work, but [Adam] found that his model was intended for testing cosmetics and only had a colour library of skin tones, whereas the base model had a full color library. This was rather limiting, but he noticed that the only apparent difference between his model and the base model was a logo (that is, a cosmetic difference). This led him to suspect that only the firmware was holding his spectrophotometer back, so he began looking for ways to install the base unit’s firmware on his device.

He started by running X-Rite’s firmware updater. Its log files revealed that it was sending the device’s serial number to an update server, which responded with the firmware information for that device. To get around this, [Adam] tried altering the updater’s network requests to send a base unit’s serial number. This seemed promising, but he also needed a device-specific security key to actually download firmware. After much searching, he managed to find a picture of a base unit showing both the serial number and security key. After substituting these values into the requests, the updater had no problem installing the base model’s firmware.

[Adam] isn’t completely sure how accurate the altered system’s measurements are, but they seem to mostly agree with his own colour calibration swatches. It’s not absolutely certain that there are no hardware differences between the models, so there might be some unknown factor producing the few aberrant results [Adam] saw. Nevertheless, this is probably accurate enough to prove that one of his roommates was wrong about the color of a gaming console.

We’ve seen a few projects before that measure and replicate existing colors. The principle’s even used to detect counterfeit bills.

Ghost Gunner Machines Your AR-15

October 12, 2014 by Adam Fabio 193 Comments

Defense Distributed and founder [Cody Wilson] have released Ghost Gunner. Defense Distributed entered the public eye a couple of years ago with The Liberator, the world’s first 3D printed gun. Since anyone with a 3D printer can print a Liberator, it is effectively untraceable. This raised a lot of questions in the media and public eye.

Ghost Gunner is a variation on the untraceable theme. Essentially, Ghost Gunner is a CNC designed for one purpose: final drilling and milling steps for AR-15 lower receivers. The reason for this has to do with federal gun laws in the United States. According to US law, the lower receiver is the actual firearm, and is regulated. But when does a block of aluminum become a lower receiver? Here, US law states that the metal becomes a regulated receiver when the machining operations are more than 80% complete.

Anyone can legally buy a barrel, trigger, stock, upper receiver, and various other parts to build an AR-15. To complete the weapon, they only need to buy an 80% lower receiver and perform the last 20% of the metal work. This work can be performed with everything from a drill press to a milling machine to hand tools. Ghost Gunner partially automates this process, making it easier and faster to complete lower receivers and build weapons.

Defense Distributed calls Ghost Gunner an open source hardware project, though we were unable to find the files available for download at this time. It appears that the slides are made up of MakerSlide or a similar aluminum extrusion. The steppers appear to be standard Nema 17 size.

Defense Distributed says that they’ve been having a hard time keeping up with the Ghost Gunner pre-orders. At $1300 each though, we think a general purpose mill or small CNC would be a better deal.

Continue reading “Ghost Gunner Machines Your AR-15” →