Dymo 550 Thermal Printer DRM Hacking - Page 1
Forum section: electronics / general

author: EEVblog
author_rank: Unknown
timestamp: February 23, 2022, 09:01:03 am
content: So the new Dymo 550 Turbo and other 500 series models now have DRM via an RFID tag in the rollThe printer is supposedly identical to the 450 apart from the DRM stuff. And the PC software now does roll ID and label count. So I'd bet the DRM is done in the PC software and that if you spoof the PC into thinking it's a 450 then the software would just print?

author: SeanB
author_rank: Super Contributor
timestamp: February 23, 2022, 04:09:37 pm
content: Dymo paper is only good initially, they will quickly devolve to using the cheapest nastiest paper they can get soon enough, because the consumer has no choice any more, use the shyte Dymo sells, or have to change printer ecosystem. You will find many software vendors will not write for any other printers, because Dymo will pay them to write software in that only uses the particular printer.Soon you will then find that you can only use branded paper for printers as well, and they will not work with other paper other than OEM, yet the exact same paper is sold with different brands on it, and different ID's in the RFID chip, that you will have to put in the printer, which will count off the sheets till it decides the paper is finished.Incidentally, you can buy labels for under $1 per thousand, which have varying tack levels, and also labels that are designed for removal, or designed for permanence. Just have to buy a Zebra printer instead, which does not care about the label, and does not even care if the label is in the printer, or fed in through the slot in the rear so you can put the roll of 100 000 there and have it churn away 24/7 printing them. Seen them with thousands of kilometres of print on the head, and it is warrantied for a million metres of print.

author: EEVblog
author_rank: Unknown
timestamp: February 23, 2022, 10:17:21 pm
content: Quote from: SeanB on February 23, 2022, 04:09:37 pmYeah but that doesn't help people who have already invested in the Dymo ecosystem.

author: thm_w
author_rank: Super Contributor
timestamp: February 23, 2022, 11:06:13 pm
content: I don't know about the "450 and 550" are identical part. The 550 claims to be able to read the installed paper type and remaining, the 450 never claims that. So at the very least the 550 should have the additional RFID reading capability. You can see the boards in these photos are totally different (but maybe other models exist):550:https://fccid.io/RGDLW550/Internal-Photos/Internal-Photos-5092146450:https://www.ifixit.com/Guide/DYMO+LabelWriter+450+Power+Button+Assembly+Replacement/115376There may still be a way to use it as a "generic" printer, if the protection is really on the PC side as you say.This user has re-used the official RFID tag, but, it may run out after a certain amount of prints:https://www.reddit.com/r/dymo/comments/qhww6m/new_labelwriter_550_turbo_label_hack/Brady does a similar thing, with the protection is entirely integrated into the printer itself (although the printer is more expensive). They have a sticker with RFID tag deviously glued under it, so if you try to peel the sticker, the RFID IC will separate its connection, and no longer work. They will sell you a "ribbon bypass device" for $30 to get around this..

author: EEVblog
author_rank: Unknown
timestamp: February 24, 2022, 03:14:15 am
content: Quote from: thm_w on February 23, 2022, 11:06:13 pmYes, of course. But they are very likely very compatible from a driver and protocol point of view. The 500 series would just have some extra command capability to send the RFID data back.

author: Someone
author_rank: Super Contributor
timestamp: February 24, 2022, 03:36:06 am
content: Its unlikely to be entirely in the host/driver as some of the devices run standalone, reading the docs about the interface:https://developers.dymo.com/#/category/1/article/1417QuoteQuoteQuoteNFC, possibly writable? given the rich data table from the tag I dont think its simply tracking serial numbers locally.

author: EEVblog
author_rank: Unknown
timestamp: February 25, 2022, 10:10:16 am
content: Quote from: Someone on February 24, 2022, 03:36:06 amYes, seems like it's doing a bunch of stuff locally. Might be impossible to bypass the firmware via just the PC drivers.If each roll isn't individually serial numbered, and it doesn't keep track of those, then I can't see why you can't just remove a genuine tag and just tape it inside the lid?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: February 25, 2022, 10:14:27 am
content: Quote from: EEVblog on February 25, 2022, 10:10:16 amBecause the label holds a "labels used" value.One avenue for attack might be to prevent it rewriting this value, so genuine tags last forever

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: February 25, 2022, 10:16:06 am
content: Looks like all the RFID stuff is on a seperate PCB, so an approach may be to replace that board with something that always gives the "right" answers

author: NiHaoMike
author_rank: Super Contributor
timestamp: February 25, 2022, 01:15:44 pm
content: Or just replace the whole control board with an open source replacement based on Arduino?

author: wraper
author_rank: Unknown
timestamp: February 25, 2022, 01:32:05 pm
content: Quote from: NiHaoMike on February 25, 2022, 01:15:44 pmBe the one who reverse engineers the original board, and designs a new board, writes a firmware needed. FYI you cannot simply stick Arduino instead of a custom board.

author: EEVblog
author_rank: Unknown
timestamp: February 28, 2022, 05:20:50 am
content: Quote from: mikeselectricstuff on February 25, 2022, 10:16:06 amAre there teardown photos?

author: thm_w
author_rank: Super Contributor
timestamp: February 28, 2022, 10:17:16 pm
content: Quote from: EEVblog on February 28, 2022, 05:20:50 amI posted the links above.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: February 28, 2022, 10:30:30 pm
content: Looks like an NXP RFID chip - can't quite make out the number.SPI interface judging by the number of wires.

author: thm_w
author_rank: Super Contributor
timestamp: February 28, 2022, 11:25:58 pm
content: Yeah good eye, NXP, which lead me to their product selection:https://www.nxp.com/products/product-selector:PRODUCT-SELECTOR#/category/c817_c798_c1491/(wont link but filter QFN32)61833 something?, anyway they all have various encryption options: "NTAG, NTAG5, ICODE, DESFire, MIFARE frontend"

author: EEVblog
author_rank: Unknown
timestamp: March 01, 2022, 12:18:35 am
content: Quote from: thm_w on February 28, 2022, 11:25:58 pmI doubt the SPI is encrypted. Likely possible to spoof it.I doubt Dymo would have cared that much about physical hardware attacks, just the cloners making fake tags.

author: amyk
author_rank: Super Contributor
timestamp: March 01, 2022, 02:57:19 am
content: I haven't looked into this in much detail but suspect it isn't too different from the inkjet/toner cartridges with chips, except now they're wireless. It might be a simple matter of capturing the communication to figure out what it's using for commands to read/write the chip. From there, resetters and such should become quite doable....that is, unless they've somehow gone for the "deluxe" route and crypto'd everything.Related long-running thread for a slightly different product:https://www.eevblog.com/forum/projects/lexmark-toner-chip-ti046b1/

author: thm_w
author_rank: Super Contributor
timestamp: March 02, 2022, 12:48:40 am
content: More details here, confirmed NFC transmitter IC isCLRC663:https://old.reddit.com/r/dymo/comments/t153zc/any_hardware_hackers_want_to_help_dymo_550/https://old.reddit.com/r/dymo/comments/qhww6m/new_labelwriter_550_turbo_label_hack/https://imgur.com/a/BjO55ssQuoteHere is the reported NFC IC:https://www.nxp.com/docs/en/data-sheet/SL2S2602.pdf?pspll=1Its basic password protection, so they didn't want to spend the money on encrypted tags.Quote

author: amyk
author_rank: Super Contributor
timestamp: March 02, 2022, 04:39:00 am
content: How hard is it to emulate an NFC IC with an MCU? That would be my first idea of making a "self-resetting" tag, but 13.56MHz doesn't sound easy to bitbang...

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: March 02, 2022, 10:00:14 am
content: Quote from: amyk on March 02, 2022, 04:39:00 amYou wouldn't need to bitbang at that frequency - that's the carrier. The actual data rate would be significantly lower.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: March 04, 2022, 06:07:23 pm
content: Should I ....I think the read password (required to increase the counter of the tag) is 0x179AADEFThe write password (required to reset/set the counter) is most likely NOT part of the dymo firmware since it is required in factory only.Looking at the very "well" choosen read password I guess it might be something like "0x2348BCEF"The NFC pcb is connect via I2C (address 0x28) (red wire is SCL, wire next to it is SDA, other pins are GND,IRQ,???,3V3)=> A simple "proxy" (maybe a 3 cent padauk) on the I2C bus could filter the counter increment and report an increased counter. When a "new" tag is detected it could reset itself and adapt to current tag counter (so when counter reached maximum, just remove and reinsert roll and continue printing. The tag from an original roll could be removed and attache to the spool holder).=> BTW: Something I could not find in the manual of the SLIX2 tag is: "what happens if the 16 bit counter is at 0xFFFF and you send another increment?" In case it wraps around then we are golden.JS

author: SilverSolder
author_rank: Super Contributor
timestamp: March 04, 2022, 08:31:37 pm
content: Quote from: EEVblog on February 23, 2022, 09:01:03 amAmazon star ratings are no longer just an average of actual customer reviews... they are modified in some way, "for your benefit" of course. I think this changed last year, or the year before.So, you can't trust that those star ratings actually reflects what consumers think...

author: amyk
author_rank: Super Contributor
timestamp: March 05, 2022, 03:19:22 am
content: Quote from: js_12345678_55AA on March 04, 2022, 06:07:23 pmThere is an ominous "destroy" command... who wants to bet that's what gets written by the device at some point?I also noticed the datasheet says the data on the ICs are digitally signed too; this stuff is getting really creepy.

author: EEVblog
author_rank: Unknown
timestamp: March 07, 2022, 04:05:17 am
content: NFC dump from the (pitiful) label roll included with the 550Quote

author: EEVblog
author_rank: Unknown
timestamp: March 07, 2022, 05:46:00 am
content: Confirmed, the value gets written to the C0 and C1 protected bits in the RFID tag when the label is printed or a blank label advanced which is what I just tried.When I advnaced the label by one (not having printed anything) the C0 value changed from C6h to C7h at the end of memory.So there is no doubt that if you try and simply peel off the label and reuse it, that won't work. As it will presumably count down to zero and won't let you use it any more.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: March 07, 2022, 09:51:57 am
content: Quote from: EEVblog on March 07, 2022, 05:46:00 amI already wrote about that (see above).The tag gets a COUNTER INCREMENT whenever a tag feed is issued. The tag increment command needs the READ-Password to be set (which is 0x179AADEF !!!FOR MY TAG!!!, looks like they read the application note to derive passwords from UID).Meanwhile I read all the spec and have some more insights:- the SLIX2 tags used from DYMO do NOT have the NXP factory "Originality Signature" embedded, instead a CUSTOM signature from DYMO is used.(the signature is just signing the UID of the tag, it is static for every UID. Spoofing of tags is still possible, one just needs to read UID + SIGNATURE from a valid dymo tag)- it is UNLIKELY that they track used UIDs in firmware of the STM32 main MCU. If they would, there is no reason to implement the counter inside of the tag...- "magic SLIX" tags do exist (where you can set UID yourself), however magic "SLIX2 tags" are not available YET... for sure they will come soon (Toniebox, Dymo, variuos ticketing systems, ... all use SLIX2)(in a magic SLIX2 tag you just need to set the UID + SIGNATURE (taken from original tag))- spoofing the complete RFID reader PCB (simple I2C) seems to be a trivial task. In reality only a handful of commands are used which are sent to the tag:Code:w: 0x36 0x01 0x00 0x00 (INVENTORY)r: (0x00) 0x01 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 (=> DSFID + UID)w: 0x22 0x23 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 0x00 0x03 (READ MULTIPLE BLOCKS: BLOCK = 0x00, LEN = 0x3 BLOCKS +1)r: (0x00) 0x03 0x0A 0x82 0xED 0x86 0x39 0x61 0xD2 0x03 0x14 0x1E 0x32 0xB6 0xCA 0x00 0x3Cw: 0x22 0xBD 0x04 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 (READ SIGNATURE)r: (0x00) 0x33 0x4A 0x63 0x63 0xD0 0x13 0x49 0xDB 0xA0 0x9E 0xEE 0x15 0x1E 0xF8 0xF8 0xF3 0xFA 0x15 0xF5 0x77 0xE4 0x4D 0x75 0x9B 0x78 0x14 0xCA 0xD3 0x7E 0x02 0xEF 0x10w: 0x22 0x2B 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 (GET SYSTEM INFO)r: (0x00) 0x0F 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 0x01 0x3D 0x4F 0x03 0x01w: 0x22 0x23 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 0x00 0x03 (READ MULTIPLE BLOCKS: BLOCK = 0x00, LEN = 0x3 BLOCKS +1)r: (0x00) 0x03 0x0A 0x82 0xED 0x86 0x39 0x61 0xD2 0x03 0x14 0x1E 0x32 0xB6 0xCA 0x00 0x3Cw: 0x22 0x23 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 0x03 0x0F (READ MULTIPLE BLOCKS: BLOCK = 0x03, LEN = 0xF BLOCKS +1)r: (0x00) 0xB6 0xCA 0x00 0x3C 0x36 0x42 0x0C 0x33 0x53 0x30 0x37 0x32 0x32 0x34 0x30 0x30 0x00 0x00 0x00 0x00 0x00 0xFF 0x04 0x01 0x01 0x00 0x00 0x00 0xA3 0x03 0x1E 0x00 0x26 0x00 0x00 0x00 0x00 0x00 0x0F 0x00 0x76 0x03 0x65 0x01 0x00 0x00 0x00 0x00 0x85 0x01 0x34 0x00 0x75 0x09 0x05 0x00 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00w: 0x22 0x23 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 0x14 0x07 (READ MULTIPLE BLOCKS: BLOCK = 0x14, LEN = 0x7 BLOCKS +1)r: (0x00) 0xD7 0xFA 0x00 0x1C 0x14 0xC2 0x5D 0xBC 0x00 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x00 0x00 0x00 0x3D 0x3C 0xEA 0x07 0x00 0x00 0x00 0x00 0x00 0x00w: 0x22 0x23 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 0x1E 0x0C (READ MULTIPLE BLOCKS: BLOCK = 0x1E, LEN = 0xC BLOCKS +1)r: (0x00) 0x32 0x8C 0x00 0x30 0x3E 0x50 0xEC 0x31 0x00 0x00 0x00 0x00 0x2D 0x07 0xA6 0x12 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00w: 0x22 0x23 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 0x32 0x0B (READ MULTIPLE BLOCKS: BLOCK = 0x32, LEN = 0xB BLOCKS +1)r: (0x00) 0x11 0xF3 0x00 0x2C 0xDD 0xC3 0x3E 0x91 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00w: 0x22 0xB2 0x04 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 (GET RANDOM NUMBER)r: (0x00) 0xEF 0x30 (=0x30EF)w: 0x22 0xB3 0x04 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 0x01 0x00 0x9D 0x75 0x27 (SET PASSWORD: READ_PASS)r: (0x00)w: 0x22 0x23 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 0x4F 0x01 (READ MULTIPLE BLOCKS: BLOCK = 0x4F (79), LEN = 0x1 BLOCKS +1)r: (0x00) 0xC7 0xFF 0x00 0x01w: 0x22 0x26 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 (RESET TO READY)r: (0x00)w: 0x22 0x26 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 (RESET TO READY)r: (0x00)...w: 0x22 0x26 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 (RESET TO READY)r: (0x00)w: 0x22 0xB2 0x04 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 (GET RANDOM NUMBER)r: (0x00) 0xB7 0x38 (=0x38B7)w: 0x22 0xB3 0x04 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 0x01 0x58 0x95 0x2D 0x2F (SET PASSWORD: READ_PASS)r: (0x00)w: 0x22 0x21 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 0x4F 0x01 0x00 0x00 0x00 (WRITE BLOCK: BLOCK=0x4F (79), DATA = 0x01 0x00 0x00 0x00 (increment counter))r: (0x00)w: 0x22 0x23 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 0x4F 0x01 (READ MULTIPLE BLOCKS: BLOCK = 79, LEN = 0x1 BLOCKS +1)r: (0x00) 0xC8 0xFF 0x00 0x01w: 0x22 0x26 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 (RESET TO READY)r: (0x00)w: 0x22 0x26 0xBA 0x6C 0x60 0x3D 0x08 0x01 0x04 0xE0 (RESET TO READY)r: (0x00)...The "increment counter" is checked immediately after the increment. But nothing else is there or even available to prevent spoofing of ORIGINAL tags.It is also very unlikely that DYMO ever implements a "blacklist" (theoretically they could, especially in combination with the host pc reading the UID and an online connection), BUT since one can read the tags within the original box in the shop (without purchasing them) this would put DYMO at risk reporting original material as bad just because somebody did a readout of the box before it was pruchased...The complete "solution" from DYMO is based on the WRONG SECURITY SCHEME.ICODE SLIX2 is just the wrong tag. ICODE DNA would have been the correct choice... But for sure they needed to save moneyOpen questions:* what happens when the counter is 0xFFFF and it is incremented? (in case it wraps around... if counter is <0xFFFF then you can print)* can we "find" the write password by guessing (in case it could be found... the counter could be written to any value, the datasheet does not mention a lock after several wrong tries, just a reset of the tag is enough)JSReferences:https://www.nxp.com/docs/en/data-sheet/SL2S2602.pdfhttps://www.nxp.com/docs/en/application-note/AN12366.pdf3.5 Reprogrammable originality signatureNXP offers to either lock the pre-programmed NXP originality signature, or to allowcustomers to re-programm and lock the originality signature.Following steps for Originality Signature generating and reprogramming arerecommended:1. Generate a public and private key for the parameters secp128r12. Create and Sign Originality Signature with private key3. Verify the Originality Signature with public key4. Program the Originality Signature into IC memory5. Lock the Originality SignatureHigh res picture of annotated mainboard of DYMO550:

author: amyk
author_rank: Super Contributor
timestamp: March 08, 2022, 02:26:44 am
content: Quote from: js_12345678_55AA on March 07, 2022, 09:51:57 amOrwritethe tags too...and that ominous command starting with "D" suddenly becomes even more interesting.

author: EEVblog
author_rank: Unknown
timestamp: March 08, 2022, 09:47:18 am
content: FYI, I get nothing out of the UART header regardless of what I do with the boot or reset buttons.Reset button works and turns off the printer (into standby), but pressing or holding boot under various scenarios does nothing.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: March 08, 2022, 10:35:13 am
content: Quote from: EEVblog on March 08, 2022, 09:47:18 amThis is "normal" ... since the STM32F072 is in RDP Level 2 (Readout Protection Level2 = all debug interfaces disabled, bootloader will not start).JSHere a pointer to "attack" STM32F0 RDP protection. Looks like level2 only can be attacked via decapping and selective UV light.https://www.aisec.fraunhofer.de/en/FirmwareProtection.html

author: EEVblog
author_rank: Unknown
timestamp: March 08, 2022, 11:31:37 pm
content: Photos of the 550Dymo 550 LabelWriter Label Printer PCBbyDave Jones, on Flickr

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: March 09, 2022, 08:16:57 am
content: Great video.I will continue to create a simple tag emulator which plugs in to the I2C interface.The good part: The printer will accept the standard non dymo rolls I use and I will have a nice NFC I2C adapter for other projectsJS

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: March 09, 2022, 09:51:29 am
content: If it uses the RFID to identify the label type, presumably there is no way to manually tell it the label size in the software.So presumably an emulator would need a way to provide that functionality as well.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: March 09, 2022, 11:44:55 am
content: Quote from: mikeselectricstuff on March 09, 2022, 09:51:29 amSure it is used. But I only use one type of label all the time.A more sophisticated emulator could be a man in the middle filtering the I2C commands to read/ increment the counter and only emulate them. All the other reads are forwarded to the reader/tag of the inserted roll.JS

author: SmokelessCPU
author_rank: Newbie
timestamp: March 09, 2022, 09:11:55 pm
content: An interesting thing could be trying dumping the firmware, maybe the STM32 IC that they have onboard has still the ST vulnerable BOOTLOADER, maybe a voltage glitch to downgrade from RDP 2 to RDP 1 is still required to access the BOOTLOADER interface...Once dumped the firmware Appling a patch (or getting the NFC password) will not be that difficult, and maybe that mod could be even pushed through USB (if support DFU mode)..https://prog.world/read-secure-firmware-from-stm32f1xx-flash-using-chipwhisperer/https://blog.zapb.de/stm32f1-exceptional-failure/

author: Refrigerator
author_rank: Super Contributor
timestamp: March 09, 2022, 09:19:56 pm
content: What does it do when it advances the paper but fails to write to the tag?Does the printer advance the paper before or after it writes to the tag?Also looks like it pulls the interrupt line high anytime it detects a roll, so what if the NFC board is disconnected and a pullup to the interrupt line is added?

author: tszaboo
author_rank: Super Contributor
timestamp: March 09, 2022, 10:21:38 pm
content: We are using these label printers in our production, to ID and serialize our product. Not the cheap paper one, the higher end one. We even went ahead, and designed in a recess in the enclosure for a selected Dymo label. And guess what, it is nowhere to be found in that size anymore. They just obsoleted a size of a label, which we have the perfect size recess designed into an injection mold.So, we ordered third party labels that were custom made for us. Luckily we don't have this abomination of vendor lock-in printers. They can go to hell.mod: Or maybe it was Zebra. They can both go to hell.

author: mistial_dev
author_rank: Contributor
timestamp: March 09, 2022, 10:37:45 pm
content: Going through the software side of things, they also have some nasty region locking that isn't happening yet. If you put in the wrong region media, it will pretend it doesn't exist.The tags themselves largely correlate to the info from the developer documentation, though.https://webcache.googleusercontent.com/search?q=cache:AoemJ-ugkRIJ:https://developers.dymo.com/+&cd=1&hl=en&ct=clnk&gl=caThe blog is down, so that's a webcache version. I've attached a dump from a proxmark3 of a virgin tag if anyone wants one to work from.The DRM seems to be tied to the SKU, so I'm working on a modchip to emulate the NFC functionality, with BLE functionality so an app can use it. The whole thing is going to be open source and open hardware, I won't be selling them.I'm going to use a PSOC 4 BLE as a base. They are cheap, easy enough to support and build on, and natively do 1.71v-5v, which will simplify the hardware.

author: mistial_dev
author_rank: Contributor
timestamp: March 09, 2022, 10:41:01 pm
content: Quote from: mikeselectricstuff on March 09, 2022, 09:51:29 amThe label has its dimensions encoded into the label. I haven't seen any firmware update functionality so far, so it's much easier to update the label to support new sizes than to firmware update the printer.If one has a tag writer or emulator, you can provide those values. You are still stuck to "authorized" SKUs for a region in terms of the software, which has code to pretend no label is inserted if it doesn't like what you provide. A software patch may be necessary there as well.

author: mistial_dev
author_rank: Contributor
timestamp: March 09, 2022, 10:47:13 pm
content: Quote from: wraper on February 25, 2022, 01:32:05 pmA CY8CKIT-059, on the other hand, would get the job done nicelyLike an Arduino, but the PSoC has some nice IO and programmable logic. I use them for all kinds of interface projects. If you don't mind putting an extra USB port on the side of your dymo, they could indeed be a drop in replacement.

author: apelly
author_rank: Unknown
timestamp: March 09, 2022, 11:04:49 pm
content: Quote from: tszaboo on March 09, 2022, 10:21:38 pmI've never heard of anyone using anything other than zebra in a commercial/production environment. This dymo brand seems to be for office users.I was impressed with the number of brands I have to avoid now though...https://www.newellbrands.com/our-brands

author: WilliamT
author_rank: Newbie
timestamp: March 09, 2022, 11:13:16 pm
content: Dear EEVBlog,Thanks for your latest video and I hope you will consider my humble suggestion.@21:38 in your video you recommend throwing out the labeller, I would like to suggest returning it for a refund under the Australia Consumer Guarantee.Everything Australian consumer needs to know about this topic can be found by searching "ACCC Repair, replace, refund" and then following up with a search for "Consumer Affairs" in their state government for any state specific procedures and I recommend following these procedures to the letter.If I was in this position, I would argue that the Dymo Labeller (and any labels I felt I had been forced to purchase) had a "Major Defect" because "it has a problem that would have stopped someone from buying it if they’d known about it".As I imagine you purchased the device with the intent of being able to use your existing label stock or 3rd party labels, you could argue that you were not informed by the device packaging, the sales person assisting you or the website from which you purchased the device that the device uses DRM to enforce the use of original DYMO labels and that the use of old label stock and 3rd party labels will deactivate the device. If you had know this you would not have purchased it.We have all seen the warnings "Use original parts only" etc. etc before where 3rd party / aftermarket parts work just fine. I would claim that the warnings on the DYMO packaging are of the same vein and do not inform the user that the device will be immediately deactivated if old stock or 3rd party labels are installed.I have had the unfortunate experience to go through this process twice in recent months and would be happy to post further on my experiences, if people are interested.Best of Luck,WOne final word, Store policies are for employees only. They have no bearing on you as a customer.

author: mistial_dev
author_rank: Contributor
timestamp: March 09, 2022, 11:32:36 pm
content: WilliamT raises a very good point. There may be many similar laws around the world.I am not an expert in EU laws, for example, but I was under the impression that the EU has specific regulation for tying the purchase of one product to another. It’s good advice to take advantage of local consumer protection laws, as well as merchant guarantees.As one of the original keurig 2.0 hardware hackers, I can tell you that Wal-Mart Keurig 2.0 devices in the US quickly removed DRM, even as the box said it still had it. I suspect that Wal-Mart got tired of returns.

author: EEVblog
author_rank: Unknown
timestamp: March 10, 2022, 12:19:01 am
content: Quote from: WilliamT on March 09, 2022, 11:13:16 pmSure, if you can do that, do it.And be sure to leave a negative review.

author: EEVblog
author_rank: Unknown
timestamp: March 10, 2022, 12:21:09 am
content: FYIDymo have replaced all their old Amazon 450 listing with the 550 meaning that the old (good) reviews stay in place. The sheer balls on them!https://www.amazon.com/dp/B08TMG88RP/You can see the old reviews are dated before the 550 was released. All the new reviews are all 1 star obviously, but because there are near 1000 old reviews, it still shows as 4.5 star rating.

author: thm_w
author_rank: Super Contributor
timestamp: March 10, 2022, 01:35:10 am
content: You can sort by review date:https://www.amazon.com/DYMO-Label-Printer-LabelWriter-Thermal/product-reviews/B08TMG88RP/ref=cm_cr_getr_d_paging_btm_next_4?ie=UTF8&reviewerType=all_reviews&sortBy=recent&pageNumber=11It was actually a prior listing for Dymo small multipurpose labels, not for a 450 printer itself.. super scammy.About 90 of the written reviews are for the 550, the remaining ~160 are for labels.https://blog.bobsledmarketing.com/blog/the-challenges-of-rebranding-on-amazonunclear what the rules are or if they are enforced.

author: mistial_dev
author_rank: Contributor
timestamp: March 10, 2022, 01:36:55 am
content: It can be either a countdown or a countup. It's described in the developer link I posted.

author: mistial_dev
author_rank: Contributor
timestamp: March 10, 2022, 04:15:41 am
content: Anyone recognize that wire to board connector on the NFC PCB? I don’t think it’s JST. Molex maybe?

author: sleemanj
author_rank: Super Contributor
timestamp: March 10, 2022, 08:43:22 am
content: Amazon shouldn't even allow you to do a sneaky product swap like that, a major failing of the system and gives them (Amazon) a bad name. Surely there must be something in the T&C that prevents it at least if not a technical solution.

author: sleemanj
author_rank: Super Contributor
timestamp: March 10, 2022, 08:50:04 am
content: As for alternatives, my Brother 720NW will be prised from my cold dead hands.I use it for both shipping and general purpose with continuous label rolls, it has an auto cutter so a 62mm label of any length from about 15mm is printable (need enough to grab hold of).Of course I do not buy original brother rolls, just knockoffs.For shipping labels I have a script which detects a new shipping label PDF generated by teh courier's system splits it in two (because the brother is only a 62mm wide printer) and does a bit of massaging before printing.

author: hans
author_rank: Super Contributor
timestamp: March 10, 2022, 09:21:11 am
content: Quote from: amyk on March 02, 2022, 04:39:00 amNot all that hard. I've been researching custom (UHF) RFID tags.. all you need is a diode receiver and an antenna switch.These tags communicate with backscatter (far-field, UHF) or load modulation (inductive, 13.56MHz). The reader>label comunnicates by sending a carrier signal with ASK modulation (the NXP chips says a depth of 20-30%, or optionally 100%). The tag harvests energy from this carrier signal to power up, so 100% won't be used for passive tags. The label>reader communicates by shorting it's antenna or coil connection, which the reader can sense and demodulate the transmitted data.The bitrate at which this happens is only in the order of kbps. These RFID tags only contain a few dozen bytes, maybe 256 for large tags, so it doesn't take long to read them.The protocol is probably the tougher issue. I'm not sure what the NXP NFC tags use, or if it's proprietary. For UHF RFID tags most commonly EPCgen2 is used. It's quite an extensive standard, and also not really a mainstream industry to work on the tag side of things.. so probably requires a lot of investment to get a small result on the software part.If the I2C is unprotected yet the tag is password protected... then the password should be somewhere in the I2C serial stream when a label gets printed.I wonder what happens if you can get a new tag (or change the existing tag), and use a different password on it. Just write the original memory contents to that tag. If the password is changed, then the Dymo printer won't unlock the tag and can't decrement the remaining labels counter. Not sure if they are smart enough to check if the sent password will unlock the tag (or that the write was successful). If not, that should create a permanent fix, without the need of repeatedly "refreshing" the NFC tag, or diving into custom I2C slaves that emulate a dummy NFC reader.edit:Oh I see the counter decrements on RD commands, instead. That complicates things a bit.Still wondering if it's necessary to make a complete NFC clone. Perhaps sniffing for the first 24-bits of the code on the bus, and then corrupting the last few bits (just pull on SDA for a few cycles), is enough to make the RD operation invalid and have it not decrement. Again not sure if Dymo firmware deals with that situation, but the above can probably be done on a 30ct PIC.

author: chefkoch84
author_rank: Contributor
timestamp: March 10, 2022, 10:43:49 am
content: Free speech at Amazon (#pay_to_win)Edit:tl;dr; Amazon blocks new reviews because of "unusual reviewing activity on this product"Just have seen the EEVBlog2 Channel Video.With that it gets even crazier:They mix in old reviews (before DRM) and do not allow new reviews that would call them out !!!!!!Does look quite fishy to me...I might bye it... write the review.. and return it ;-) JUST TO FUCK THEM OVER:(only the e-waste is a sad aspect of this strategy)

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: March 10, 2022, 11:13:51 am
content: Quote from: mistial_dev on March 09, 2022, 10:37:45 pmVERY interesting... especially the "Counter Strategy" which is set to 1 on my rolls => 0x01 = Counting up from 0xFFFF – “amount of labels” – “Counter margin” to 0xFFFF.It also seems that just the CRC32 in front is used to "protect" that data.And since for some reasons my rolls do NOT report to have a write protection for the data blocks... I will try to set "Counter Strategy" to 0 and check what happensAfter updating the NXP Tag Info app it no longer shows the first 32 blocks as writeable (seems was a bug in nxp app before).Time to "guess" the write password.Maybe that easyJS

author: Psi
author_rank: Super Contributor
timestamp: March 10, 2022, 11:54:40 am
content: Quote from: amyk on March 08, 2022, 02:26:44 amwow. The TV-B-Gone tool has some competition, DYMOLabel-B-EmptyDYMO really have opened themselves up to a HUGE disaster if anyone gets the write password and builds a long range label tag writer.Considering the write password may only be a 4byte number that ain't going to take long.

author: AlienRelics
author_rank: Unknown
timestamp: March 10, 2022, 12:58:31 pm
content: I gave up on Dymo label printers when they stopped supporting the older serial and USB label printers due to a new Windows version. Funny, the new software for the new printers works just fine in the newer version.They simply decided you have to buy a new printer by locking you out of the older printers.As for Amazon, they decided based on no actual evidence that my reviews were "suspicious" and I can no longer post reviews at all.

author: AlienRelics
author_rank: Unknown
timestamp: March 10, 2022, 12:59:37 pm
content: Remember ESC codes? I could make my dot matrix printer dance. And the ESC codes were printed in the printer manual!

author: LightTangent
author_rank: Newbie
timestamp: March 10, 2022, 06:50:41 pm
content: Hey Dave,Thanks for the great YT vid as always!I noticed they've been doing a similar trick (on Amazon) in the UK, although it's rather interesting when you dig a little deeper.They're pretty sneaky about it though... For example this listing:https://www.amazon.co.uk/LabelWriter-Printing-Automatic-Recognition-Shipping/dp/B09DY3YT4YHas 3 different "models" - 2 of which are labels (which are what the majority of comments relate to), and 1 is the actual printer.If you check the price history of the printer, it seems to have been added on Sept 24th (which seems a little early for the 550, but plausible I guess). Originally about £150, now around 100. I'm assuming it's the same printer though.https://uk.camelcamelcamel.com/product/B09DY3YT4YIf you check the labels, however, It seems that as expected they've only fairly recently had the DRM added.https://uk.camelcamelcamel.com/product/B00028XNN6https://uk.camelcamelcamel.com/product/B000HEZD7EOne label that from about 2019 through Late 2021 was around the 15 quid mark, has since jumped up to 22 quid, a 50% markup. Clearly the "DRM" flavour?Another from 8 quid since around 2013 until late 2021, and then BOOM! 11 or 12 pounds.There's around 1,000 (about 93% at 4* and above) reviews and of course the majority have naff-all to do with the 550 label printer."I've owned my LabelWriter 450 Turbo for ten years now, "..."Have used these in my Dymo label printer for many years. Great for Christmas card addresses,"...etc.Tried to send an email to Amazon to complain and got a fairly standard form response back feigning ignorance about what I was suggesting. They suggested if there's a problem with a particular review, to click the "Report" button (well, bugger clicking all of them!), or to get back to them with a specific ASIN number so they can investigate (which bearing in mind I provided 3 or 4 different links they already had!)Interestingly then it seems that the deviant flaw in the whole system is that you can advertise multiple unrelated products under a single slug and present them as "models", even if that means you're selling completely different things - and the reviews are all aggregated under the same slug rather than each individual ASIN... and clearly Amazon just don't give a rats about it.Tony

author: mistial_dev
author_rank: Contributor
timestamp: March 10, 2022, 07:12:54 pm
content: Quote from: sleemanj on March 10, 2022, 08:43:22 amAmazon does have a report seller option.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: March 10, 2022, 07:25:24 pm
content: Just found that the READ password is different per TAG.Looks like dymo followed the application note from NXP to use "dynamic passwords" derived from UID.=> Labels in shops are safe. Nobody can invalidate (use) them. Also the "destroy" command has its own password (per tag for sure) which we don't know...This means full tag emulation or waiting for "magix SLIX2 tags" are the only options.JS

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: March 10, 2022, 07:52:41 pm
content: Quote from: js_12345678_55AA on March 10, 2022, 07:25:24 pmThere are ways to remotely destroy RFID tags without the password, just sayin'..

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: March 10, 2022, 08:05:44 pm
content: Quote from: mikeselectricstuff on March 10, 2022, 07:52:41 pmSure... microwaves... but this could also be used to destroy the adhesive of non RFID tags (cooking them in the shop), just sayin'...

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: March 10, 2022, 08:21:53 pm
content: Finished some more tests.The counter in SLIX2 tag is capped at 0xFFFF. Any attempt to increment the counter which has 0xFFFF as value gives an error response. Documentation of SLIX2 did not explain this.JS

author: Psi
author_rank: Super Contributor
timestamp: March 11, 2022, 03:05:59 am
content: Quote from: js_12345678_55AA on March 10, 2022, 07:25:24 pmOk, so they're not totally stupid then.I've never really looked into NFC. Out of interest, if they had used the same password for each tag.What sort of physical distance would you need to zero all the labels in big stack of pallets?Assuming you had all the right equipment could someone have parked a van outside an amazon warehouse and cleared all the labels inside? Or would you need to get within 10m or so even with the best RF setup possible?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: March 11, 2022, 09:07:16 am
content: Quote from: Psi on March 11, 2022, 03:05:59 amthe inverse square law limits how far you could do anything, even with a lot of tx power - anything over about 1m would be impractical

author: mistial_dev
author_rank: Contributor
timestamp: March 11, 2022, 12:49:20 pm
content: Quote from: js_12345678_55AA on March 10, 2022, 08:21:53 pmYes, it would be.Quote from: js_12345678_55AA on March 10, 2022, 08:21:53 pmIt's a 16 bit counter, intended for consumption ("service cycle") tracking and similar. If it rolled over, it would not be useful for that purpose.If you read in 9.5.3.21, it describes the available options: read, increased by one, and reset to preset value with write.If it rolled over from 0xFFFF to 0x0000, it wouldn't be an increment by one. It would be a decrement by 65535.There is technically a 3rd byte in the block, where it could continue increasing. That value is listed as RFU, however, in the documentation.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: March 11, 2022, 01:21:42 pm
content: Quote from: mistial_dev on March 10, 2022, 04:15:41 amI measured the pitch to be 1.5mm which is identical to "JST ZH 6pin"Unfortunately this is incorrect. JST ZH is still to big.JSBTW: I found the 6th pin meaning. It is "PDOWN" which has a pull up. When PDOWN is connected to GND then the reader IC is starting operation. PDOWN not connected or +3.3V then reader IC is powering down.I also found a quick way to soft-reset the reader IC (tag connection) to speed up something like trying passwords:when you- send 0x00,0x80 (command_reg,power down flag set)- wait 50 msec- send 0x00,0x00 (command_reg,power down flag cleared)then you do not have to send the long reader initialization sequence (programing all registers and protocol selection) and just can transceive the next commands to the tag (get random + set password for next try).Still with only 10 tries per second, guessing the 32 bit write password could take some time (>6 years). But for sure this can be speed up a lot... Only caveat, write password is most likely different per tag

author: mistial_dev
author_rank: Contributor
timestamp: March 11, 2022, 01:50:32 pm
content: I'm not too worried about the password at this point. It looks like it is handled by the NFC chip, not the MCU, so I think it can largely be ignored if that chip is emulated.My plan right now is to just have a BLE chip and an app where you can pick the SKU for the inserted media. Since third party media won't have a RFID chip, that information will have to come from a database of some sort. USB is simpler to implement, but requires physical modification to the case.

author: amyk
author_rank: Super Contributor
timestamp: March 11, 2022, 02:28:31 pm
content: Quote from: hans on March 10, 2022, 09:21:11 amI am reminded of these:https://hackaday.com/2009/06/27/avr-rfid-tag/https://hackaday.com/2011/09/26/barebones-pic-rfid-tag/https://hackaday.com/2018/01/05/attiny-chip-abused-in-rfid-application/Those are all 125kHz, but here's a 13.56MHz one:https://hackaday.com/2013/11/14/a-diy-nfc-tag/The IC used in the Dymo is ISO 15693 protocol, which is different from those above, but I suspect based on the existence of the last one, it should be emulatable.

author: mistial_dev
author_rank: Contributor
timestamp: March 11, 2022, 02:35:19 pm
content: That would work, too.I'm ripping out the whole NFC board and replacing it with an NFC IC emulator. The advantage to that is that you don't actually need a tag at all, and can skip RF entirely.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: March 11, 2022, 04:37:38 pm
content: What IC to use for the I2C emulator...Looking on availability of ICs and reproducability for others I'm looking at Arduino libraries (even that I don't like them).There are I2C slave libs available which can be used on almost all platforms (AVR,STM32,ESP32,...)Suggestions?

author: Julius
author_rank: Contributor
timestamp: March 12, 2022, 12:24:17 am
content: Get it working on Arduino and everybody will be able to port to their favorite IC.

author: Monkeh
author_rank: Super Contributor
timestamp: March 12, 2022, 12:52:17 am
content: Quote from: js_12345678_55AA on March 11, 2022, 04:37:38 pmOne you can actually buy.

author: EEVblog
author_rank: Unknown
timestamp: March 12, 2022, 01:45:13 am
content: FYI, amazon said on twitter they would do something about it and a few hours later a ton of old reviews have been removed.

author: mistial_dev
author_rank: Contributor
timestamp: March 12, 2022, 02:56:47 am
content: Quote from: js_12345678_55AA on March 11, 2022, 04:37:38 pmCY8CKIT-059 if you want USB. CY8CKIT-042-BLE-A if you want BLE.

author: sleemanj
author_rank: Super Contributor
timestamp: March 12, 2022, 10:41:12 pm
content: Quote from: EEVblog on March 12, 2022, 01:45:13 amProbably only from that specific listing you had, where as this was the first one I got when googling for "amazon labelwriter 550" and has 7.4k reviews dating back years.https://www.amazon.com/DYMO-Label-Printer-LabelWriter-Thermal/dp/B08TLRL392/ref=cm_cr_arp_d_product_top?ie=UTF8&th=1

author: GopherT
author_rank: Contributor
timestamp: March 13, 2022, 04:43:47 am
content: Looks like someone was fired over this...Demo is looking for a new Product Manager/Brand Manager.https://careers.newellbrands.com/us/en/job/2200802/Product-Manager-Brand-Manager-DYMO

author: ygi
author_rank: Regular Contributor
timestamp: March 13, 2022, 04:34:54 pm
content: Quote from: GopherT on March 13, 2022, 04:43:47 amIf someone got fired/quit it had to be because they were the one person in the company opposed to that stupid cash grab. No corporate drone's ever been fired for being too greedy on behalf of their employer.

author: DynoDrmBeGone
author_rank: Newbie
timestamp: March 13, 2022, 07:05:31 pm
content: Just noticed something and hope it might help in figuring a way to defeat this insane DRM protection...When I'm printing labels from my MacBook pro M1 it tends to print an empty lable after the original print... However if u unplug the USB cable from my Mac directly after the first lable is done printing, the empty lable isn't generated, but even better if I cancel the print job without the USB cable and reconnect the printer the lable count isn't decremented so you can print without decreasing or incrementing the nfc counter and it will still accept to print the next lable afterwards... I now have an empty roll wit 32 prints left

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: March 13, 2022, 10:11:13 pm
content: If there is a significant delay between it reading and writing the RFID tag, maybe a possible approach is to jam the signal with an external (modulated) 13.56MHz source to block the write.

author: DynoDrmBeGone
author_rank: Newbie
timestamp: March 13, 2022, 10:41:06 pm
content: Wouldn't it theoretically be possible to create a write locked NFC tag, with the expected Dymo data on to it? Than the printer can do it's roll type detection, thinks it's already used for some prints so it doesn't have to do any initialisation (if it even does that on the first print) and simple can't decremented the counter?

author: apelly
author_rank: Unknown
timestamp: March 13, 2022, 11:01:37 pm
content: Quote from: GopherT on March 13, 2022, 04:43:47 amFrom that page:Quote

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: March 14, 2022, 11:55:19 am
content: Looks like all those Arduino libraries do not support I2C slave very wellI tried ESP32, STM32 (we need a 3.3V MCU).Next best thing would be to use native STM32 for emulation (stm32 blue pill boards seem to be available everywhere, even boards with cloned STM32 should work)JSBTW: The mentioned "CY8CKIT" Infineon IC / board is expensive and ICs are not available as far as I can see. Any particular reason why this was suggested?

author: mistial_dev
author_rank: Contributor
timestamp: March 15, 2022, 09:08:09 pm
content: Quote from: js_12345678_55AA on March 14, 2022, 11:55:19 amThe cy8ckit-059 has apparently had a price increase.They used to be $10, which was a great value for the chips you get with it. Looks like infineon has hiked things a bit.https://www.reddit.com/r/PSoC/comments/360r4p/10_for_cy8ckit059_has_cypress_psoc_5lp_target/They still have some really nice i2c support, though, and it is very easy to work with.https://www.infineon.com/dgdl/Infineon-Component_I2C_V3.30-Software+Module+Datasheets-v03_05-EN.pdf?fileId=8ac78c8c7d0d8da4017d0e9599661ff4The biggest advantage with cypress is that as long as you are doing something that's officially supported, the libraries/tools/etc. you need are all first party, and tend to be fairly top notch.The disadvantage is when you want to go beyond what's officially supported. The tooling stops helping you and starts fighting you.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: March 16, 2022, 03:14:15 pm
content: I decided to use a STM32F103 since they are (still) available for reasonable prices from various sources. Anything like a "blue pill" will work.And..... IT IS WORKING!Full emulation of the reader IC + tag as a standard CubeMX project.Whenever the roll is changed or the printer enters power down mode the counter is "REFRESHED"Next step... I additionally interface the original reader so change of paper types is easy (just hold a tag of the paper type you want to use to the side of the printer and the emulator will "LEARN" it).JS

author: mistial_dev
author_rank: Contributor
timestamp: March 16, 2022, 09:15:03 pm
content: That’s smarter than what I was planning.If you are planning on releasing, I’ll stop working on mine.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: March 16, 2022, 11:43:11 pm
content: Quote from: js_12345678_55AA on March 16, 2022, 03:14:15 pm...but that assumes you've already bought some of the original expensive labels...

author: mistial_dev
author_rank: Contributor
timestamp: March 17, 2022, 12:22:35 am
content: Or have cloned the tag to a card.

author: Bud
author_rank: Super Contributor
timestamp: March 17, 2022, 02:33:29 am
content: Quote from: mistial_dev on March 16, 2022, 09:15:03 pmPlease do not, we need diversity.

author: EEVblog
author_rank: Unknown
timestamp: March 17, 2022, 04:27:13 am
content: Quote from: js_12345678_55AA on March 16, 2022, 03:14:15 pmA DIP switch maybe?Most people stick with the same roll in the sme machine all the time, and there are mostly only a coulple of major label sizes people use.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: March 17, 2022, 01:25:06 pm
content: Thanks for the suggestions...The emulation contains "learned" labels already, and if you use it like I do (multiple rolls per day all of the same type) then this is just enough.Switching between rolls can be done using either another original roll (which is then learned) or by using a simple of the shelf NDEF Tag where you just write the SKU of the roll (e.g. "S0722430") inside (like you do with business card information, any phone can do this nowadays).So by presenting either an original roll the complete data is learned, or by presenting a normal RFID NDEF tag with the SKU inside to choose from the pre installed tags is enough to switch between rolls.This makes it possible to modify the printer once and then no need to open again in order to switch roll types.Meanwhile I also created a small Android app which can be used to dump the complete SLIX2 tag (including the "signature" data).I will setup a github project in the next few days with all the sources.(As soon as github outtage is over:https://www.githubstatus.com)On the other hand I learned about a very beautiful (and available) NXP IC today. A friend suggested to have a look at the NHS3100 IC.https://www.nxp.com/docs/en/data-sheet/NHS3100.pdfIgnore the "temperature logging" in the title... and have a look at chapter "8.10 RFID/NFC communication unit"This IC is a CortexM0 which can speak the correct NFC protocol...This makes it possible to completely emulate a SLIX2 tag with a "magic counter":The IC is (including inflated pricing) $4:https://www.digikey.com/en/products/detail/nxp-usa-inc/NHS3100-A1Z/6578221A completely working development board (which should be usable as magic tag) is availbale for $60 (Will pay itself after using only 4 off-brand rolls)https://www.digikey.com/en/products/detail/nxp-usa-inc/NHS3100TEMODBUL/6578223And I really like the idea to fight NXP with NXPLooks like the UID is fixed so this can not be usedJS

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: March 17, 2022, 06:18:05 pm
content: The first release is an Android utility application which can be used to dump the complete content of SLIX2 tags:https://github.com/free-dmo/free-dmo-tag-dumpYou just start the app, hold it near the paper roll to scan it and it will show the complete dump.It also will create a text file per dump in the "Downloads" folder.It comes with full source code but also contains a pre compiled APK for "lazy" people (BUT: You really should NEVER EVER download APKs from somewhere and install them to your main Android device... Go the extra mile and check the source then compile it yourself!).@ALL: It would be nice if you could use the app to scan some of your rolls (doesn't matter if consumed or fresh). Please copy/paste the content of the text file and post them here.The difference of the raw dump compared to the output of other NFC apps is that it contains extra information like the Originality Signature from SLIX2 tags (which we need for a complete emulation).JSAttached are my 2 rolls. One is the small roll which comes with the printer the other one is SKU "S0722430" (54mm x 101mm | 2 1/8 x 4 inch)EDIT: One more roll attached.Anybody else please?

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: March 28, 2022, 01:56:16 pm
content: It's done...https://github.com/free-dmo/free-dmo-stm32- full emulation for "endless" printing- optional pass through of original RFID tag data (only the counter will be emulated)JS

author: mistial_dev
author_rank: Contributor
timestamp: March 29, 2022, 03:10:48 am
content: Quote from: Bud on March 17, 2022, 02:33:29 amPlenty of things to hack out there. I can do something else

author: mistial_dev
author_rank: Contributor
timestamp: March 29, 2022, 03:28:43 am
content: Here ya go. 4x6 inch, or 104x159mm. Standard shipping size.

author: SkullKill
author_rank: Newbie
timestamp: March 31, 2022, 04:33:10 am
content: #FREEDMO GETS RID OF DYMO LABEL PRINTER DRMhttps://hackaday.com/2022/03/30/freedmo-gets-rid-of-dymo-label-printer-drm/https://github.com/free-dmo/free-dmo-stm32

author: tooki
author_rank: Super Contributor
timestamp: March 31, 2022, 10:52:15 am
content: Quote from: SkullKill on March 31, 2022, 04:33:10 amYyyyyeah, we know, since the developer of that is a forum member and documented his progressin this thread.

author: SaltyDog
author_rank: Newbie
timestamp: March 31, 2022, 12:52:45 pm
content: Can someone please dump a 1x1" tag? I will dump mine, when it comes in, and if no one posts.

author: EEVblog
author_rank: Unknown
timestamp: April 03, 2022, 12:26:36 pm
content: Louis did a follow-up, and I agree. The hack, whilstworthy isn't going to make a difference I'm afraid.Those that have the motiviation/ability to do the hardware hack are those who have the motivation never to use Dymo again for this. Almost all business customers will just continue to buy the genuine Dymo labels.We need to hit Dymo hard now or every other manufacturer will see that they succeeded and they will try the same thing. We do this buy having an active anti-Dymo campaign and refusing to use their products and buying their competitors (I recommend Zebra). Keeping on top of the fake Amazon reviews and the like etc and help grow the new organic 1 star reviews. Eventually it has to hit Dymo where it hurts.

author: EEVblog
author_rank: Unknown
timestamp: April 03, 2022, 12:29:19 pm
content: And for those that want an alternative to the Dymo label software, and have support for countless printers including the old Dymos, I've been talking to the author of this software:https://label.live/He's also close to releasing his own printer as well.

author: tooki
author_rank: Super Contributor
timestamp: April 03, 2022, 07:47:52 pm
content: Quote from: EEVblog on April 03, 2022, 12:29:19 pmLooks like a nice app! Do you know whether it will support thermaltransferprinters? For durability (both against abrasion as well as against fading in long-term storage or staining due to chemical exposure) they’re practically mandatory.I’d also love to see it support laminated labels like the Brother p-touch.

author: mistial_dev
author_rank: Contributor
timestamp: April 04, 2022, 12:47:14 am
content: And here's 2.25 in x4 in.

author: okdc
author_rank: Newbie
timestamp: April 08, 2022, 06:36:44 pm
content: I attempted this with the compiled firmware from github and can't seem to get it to work on my 5XL. Any pointers? I appreciate any and all help. I've never worked with a stm32, really only ever toyed with arduino. I flashed the stm32 with a uart and with st-link. Same results. I'm on windows, so compiling isn't as simple as it should be, was trying to avoid making this any more difficult than it already is. Do I need to flash this with linux? I've double checked my solder job and I was actually quite pleased with my work, so I really don't think it's that. The color order was different, but I made sure they all matched up.The dymo software detects the label properly for about a second and then it returns to unknown label detected. I've also tried using the reader with the rfid off the roll that came with printer. No change.The printer power light just flashes like it can't detect anything.

author: wraper
author_rank: Unknown
timestamp: April 09, 2022, 05:21:52 pm
content: What are those parts with black blobs? Do not look like usual resistors which are needed. Look more like thermistors.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: April 10, 2022, 07:55:54 am
content: @okdc:In the pictures it looks like the 2 yellow BOOT jumpers are still both at the "1" position.This will let the device always enter it's bootloader and the firmware is never run.=> After flashing the firmware put the boot jumper back to the normal "0" position.Have a look here:https://circuitdigest.com/sites/default/files/inlineimages/u/STM32-Operating-and-Programming-Mode.jpgJS

author: okdc
author_rank: Newbie
timestamp: April 11, 2022, 01:34:41 pm
content: Thanks for the replies, yes it's a thermistor, it's what I had on hand. I've ordered standard resistors and they'll arrive tomorrow.Here is what I'm experiencing. I went in programming mode and flashed the pre-compiled firmware using the STM32CubeProgrammer application. I put it back into operating mode and then gave it a go.Here is a video of the results.https://photos.app.goo.gl/PuknEDYjVevKyaZ18Should I remove the reader just to rule that out? Your help is greatly appreciated!

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: April 12, 2022, 10:08:52 am
content: Quote from: okdc on April 11, 2022, 01:34:41 pmThe video shows that the printer did not communicate with the STM32 properly. You should observe the same behaviour when you unplug the STM32 completely.Quote from: okdc on April 11, 2022, 01:34:41 pmYou can remove the RFID board connection for troubleshooting. The emulation works without RFID board attached.The emulation will set SKU S0722430 (54 mm x 101 mm / 2.125 in x 4 in / 220 pcs). The PC software should show this.Questions:There is a second LED on the blue pill pcb (labeled PC13) which should blink whenever the printer sends something to the STM32.=> Do you see this LED blinking at all (should blink several times after printer is started / woken up from power save)?

author: okdc
author_rank: Newbie
timestamp: April 13, 2022, 05:31:10 pm
content: I removed the reader and sured up my solder job. There wasn't any change, also no blinky. Reflashed it, still no change. I feel like I'm missing something simple here. I've ensured the STM32 is in operating mode.Update:Just for the heck of it, I tried a new STM32 and a new Dymo 5XL. Same results. I only ever get a solid power LED, even when the printer isn't "on" and the printer is in sleep mode.

author: SaltyDog
author_rank: Newbie
timestamp: April 14, 2022, 01:10:15 am
content: I am having the same issue with the 550... Just a solid red light.

author: SaltyDog
author_rank: Newbie
timestamp: April 14, 2022, 03:08:36 am
content: Could it be because I used a STM32F103C6T6? Are you using more than one i2c port?

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: April 14, 2022, 09:40:28 am
content: Quote from: SaltyDog on April 14, 2022, 03:08:36 amThe STM32F103C6T6 is a different MCU which only has half of the RAM, half of FLASH and most problematic, only ONE I2C port (the project uses two).==> This CAN NOT WORK.However, the complete source and .ioc file is available in the github repo, so you can change the MCU in ST's "STM32CubeMX" software, generate the code, *REMOVE* the second I2C (which is used to connect to the original RFID board) and just create a custom version for your MCU with emulation only.JS@OKDC: Could you check the MCU soldered to your blue pill? Maybe it is not a "STM32F103C8Tx"

author: okdc
author_rank: Newbie
timestamp: April 14, 2022, 12:55:15 pm
content: Ughh, seems to be the potential problem. Good catch!I should have known better than to trust Amazon. This is what was orderedhttps://www.amazon.com/dp/B09MLHTHRC(Do not buy)All text in description, title, etc. says STM32F103C8T6 but the photos show what I received (STM32F103C6T6)Which is a good thing, I guess. I was losing my mind trying to figure out what I did wrong. I had even ordered a Label Writer 550 just to make sure. It'll be here soon.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: April 14, 2022, 02:42:41 pm
content: Hi,SaltyDog was spotting the C6T6 problem. I just asked you to check if by chance you have the same issue.Anyway, I added a warning to the github readme to check for correct STM32F103C8T6.JS

author: SaltyDog
author_rank: Newbie
timestamp: April 15, 2022, 10:48:10 pm
content: I can confirm that the new boards I ordered, the correct ones worked straight away, without issueThank you!

author: okdc
author_rank: Newbie
timestamp: April 16, 2022, 12:51:04 am
content: Mind linking where you purchased? My new ones don't arrive until sometime next week.

author: SaltyDog
author_rank: Newbie
timestamp: April 16, 2022, 12:58:03 am
content: I am sure you will find them cheaper elsewhere, but I wanted them right away.https://www.amazon.com/HiLetgo-STM32F103C8T6-Minimum-Development-Learning/dp/B07VKSVM21/ref=sr_1_1_sspa?crid=10ECKNKM29581&keywords=stm32f103c8t6&qid=1649905956&sprefix=STM32F103C%2Caps%2C76&sr=8-1-spons&spLa=ZW5jcnlwdGVkUXVhbGlmaWVyPUEzNENXSkMxTTk0UUVIJmVuY3J5cHRlZElkPUEwODkwMTU2MUZaRFlOMTlIUU1WTCZlbmNyeXB0ZWRBZElkPUEwMTE1NTI4M1ZPU1YwU0cySTY4WSZ3aWRnZXROYW1lPXNwX2F0ZiZhY3Rpb249Y2xpY2tSZWRpcmVjdCZkb05vdExvZ0NsaWNrPXRydWU&th=1

author: SaltyDog
author_rank: Newbie
timestamp: April 16, 2022, 01:08:47 am
content: I would also like to note that there is no need to mess with the jumper blocks, when you program via STLink.I prefer this utility.https://www.st.com/en/development-tools/stsw-link004.html

author: okdc
author_rank: Newbie
timestamp: April 20, 2022, 06:43:55 pm
content: Got it all working when I got the correct blue pill. Thanks so much for everything.Attached is the FreeDmo TagDump of a 2 5/16 x 4 in (59mm x 104mm) 300 count spool.Fun fact, I was able to scan the tag without opening the box. Do what you will with that information.

author: SirOsis
author_rank: Newbie
timestamp: July 06, 2022, 08:38:43 pm
content: Thanks for all your work on this. Ordered my stuff today should have it Friday and hopefully a working printer on Monday!Would it be possible to disable the capability of the RFID board to write updated values by introducing an open on the voltage line or is that the same voltage that is used to read. Hope that makes sense.

author: johnny32
author_rank: Newbie
timestamp: November 01, 2022, 08:25:10 am
content: Pirate Ship supports all LabelWriter 450 models. The Dymo 450 is not as great as the Munbynthermal labelsprinter; you can definitely use it with Pirate Ship! Head to Settings > General Settings and change your Label Size to 2x7".

author: jonpaul
author_rank: Super Contributor
timestamp: November 01, 2022, 08:43:31 am
content: We use 450/450 turbo, 450 twin.Bought some for $5 ea at fleas.Indeed Zebra printers are the best, but Dymo has adress label correction and USPS barcodeJon

author: jonpaul
author_rank: Super Contributor
timestamp: January 26, 2023, 02:52:30 am
content: The older model Turbo/450/twin have no DRM or RFID and work fine with clone labels as long as the registration hole is good.We find these at garage sales, fleas, etc for $5,,25,550 is hardly worth the effort!j

author: abefroman
author_rank: Newbie
timestamp: March 11, 2023, 08:35:19 pm
content: How is everyone mounting the blue pill when everything is programmed correctly?

author: Darxtek
author_rank: Contributor
timestamp: June 10, 2023, 10:51:00 pm
content: OK I’m not the biggest programmer or flasher, but I’m stuck at this part I can’t seem to get the matching pins , and my colors are off lol.Can anyone help.Soooo close!

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: June 11, 2023, 02:31:08 pm
content: Quote from: Darxtek on June 10, 2023, 10:51:00 pmWhat are you trying to do? All the definitions and code is available for STM32F103C8 already. The Pinout definition would only be needed if you want to port it to another STM32 variant.There are even pre compiled binaries of the firmware available which you just need to flash:https://github.com/free-dmo/free-dmo-stm32Scroll down and read the instrcutions, look at "Firmware" => use "option 3" and download a pre compiled firmware, then follow the steps outlined under "Download the firmware to the STM32F103 bluepill board"JS

author: Darxtek
author_rank: Contributor
timestamp: June 29, 2023, 02:52:32 pm
content: So it looks like I got everything programs correctly and I’m using 4 x 6 labels if I were to want to change label size what would I need to do flash different .bin or leave it as is?

author: czester1994
author_rank: Newbie
timestamp: August 03, 2023, 03:06:29 pm
content: Label 1/2"x1" S0722530. Please compile for .bin file. Thanks

author: Mhare
author_rank: Newbie
timestamp: September 26, 2023, 07:08:37 pm
content: Hi all,I’m new to programming never done this before. I have soldered all the wires on but I’m stuck with downloading and installing the firmware. Any help would be great thank you

author: Iomega0318
author_rank: Newbie
timestamp: October 05, 2023, 06:25:24 am
content: Long story short, I work for a school and we've been using the 450s for years with the software we use and 3rd party labels. However we have had 450s failing frequently and started replacing them with all that is available now the 550s, the software update our provider has pushed out is also no longer going to support the 450s, neither Dymo or the other company will admit to this, so we're being forced onto the 550s. Our 58+ schools that have 2-3 dymos each pay for their own labels hence the 3rd party.I have successfully soldered and programmed a board with our labels, I'll provide the dumps once I get it fully working, but have run into a weird issue. When you first power on the Dymo it doesn't recognize the board (no RFID) and therfore says no label detected, power it off from the front and back on and it works, power off and on from front no work, power off and on from front again works. It seems to be consistent that it only works ever other power cycle, green light blinks correctly when it's working as well. Any ideas?

author: Iomega0318
author_rank: Newbie
timestamp: October 05, 2023, 06:27:11 am
content: Quote from: Mhare on September 26, 2023, 07:08:37 pmWhere are you stuck, what have you tried?

author: allenlorenz
author_rank: Newbie
timestamp: November 27, 2023, 11:20:19 pm
content: Here is the dump for the dymo 30333 tag

author: imintune
author_rank: Newbie
timestamp: February 19, 2024, 09:16:29 am
content: Is there a place or someone I can just ship this 550 to get it done?

author: RethoricalCheese
author_rank: Newbie
timestamp: April 08, 2024, 01:52:41 pm
content: Hey!Looks like there has been a modification in firmware which blocks this hack.Mainboard and NFC reader are exactly the same. Bluepill works on printer with lower serial number and doesn't detect anything on higher SN. Same exact module works on all older printers and none of the newer ones.Just to be 100% sure that there are no hardware differences, I transferred microprocessors between both printers. The issue transferred aswell so it's 100% firmware difference.Used a logic analyzer to dump startup on both printers (with original wire and nfc module, no bluepill between them. Same roll on both of em).Here's the diff between them:https://www.diffchecker.com/5YVaDYkI/Kindla looks like signature is read twice and expects this:uint8_t signaturecmd[] = {0x22,0xAB,0x04,uid,uid,uid,uid,uid,uid,uid,uid};and then this:uint8_t signaturecmd[] = {0x22,0xBD,0x04,uid,uid,uid,uid,uid,uid,uid,uid};but current version of freedmo only transfers the latter.I might be way off tho..

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: April 17, 2024, 08:41:12 am
content: Quote from: RethoricalCheese on April 08, 2024, 01:52:41 pmLooks like they added another command "0xAB" to also read the "NXP_SYSTEM_INFORMATION" (seehttps://www.nxp.com/docs/en/data-sheet/SL2S2602.pdf"9.5.3.18 GET NXP SYSTEM INFOMATION", page 33)The content from this request will be static for all tags so a simple emulation should do the trick.As soon as I find some time I will try to add it.But testing needs to be done by you since I do not have (and do not plan to buy) an "updated" DMO550.JS

author: RethoricalCheese
author_rank: Newbie
timestamp: April 18, 2024, 05:20:36 am
content: Ofcourse, happy to test.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: April 22, 2024, 10:02:57 am
content: Quote from: RethoricalCheese on April 18, 2024, 05:20:36 amHere we go. Since you made such a nice diff (SERIOUSLY REALLY HELPFUL!), I assume you know how to check out a branch and compile the firmware yourself.See:https://github.com/free-dmo/free-dmo-stm32/tree/feature/nxp_system_infomation(the missing "r" in information was adpoted from original NXP document)If this works, I will merge this as well as some long-standingpull requestsJS

author: RethoricalCheese
author_rank: Newbie
timestamp: April 23, 2024, 08:41:23 am
content: Good new and bad news.It works on older SN models.It kinda works on newer SN models. It does detect emulated roll now.But the issue is that it remembers. Number of labels decrease and do not reset after a power cycle. Not even when testing on another PC.But wait, there is more. Just turning it off and on, it is unable to connect to PC. Only after capacitor discharge, it is able to connect again. But this issue is not because of freedmo. It's acting like this in stock aswell.Tested on 2 devices.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: April 23, 2024, 10:30:13 am
content: Quote from: RethoricalCheese on April 23, 2024, 08:41:23 amIt sounds like they might use internal memory on the STM32 now to store the counter of a roll UID...But I'm pretty sure they do not have unlimited memory for this and as a wild guess I would say they only remember that last <10 UID.In the source project we already have several UIDs which we can use to alternate and switch between.Can you make the following test please:* setup roll in emulation, do some decrements, switch off, switch on ==> counter in emulation resets and the printer should be in your reported "blocked state"* now change firmware and select different UID for emulation. In main.c source file change the line:#define SLIX2_TAG_EMU 1 // 1-12and use a different value (e.g. 2 )* check if printer works again, decrement some, switch off, ==> counter in emulation resets and the printer should be in your reported "blocked state"* now... change in firmware back to emulation of tag 1=> check if printer works again+ if it works, they only remember the last tag ... easy fix+ if it does not work, they might remember multiple tags... but we have more good tags for emulation.Unfortunately the only way to find out is to try them all one by one and always checking if emulation of tag 1 is coming back to liveIn case we can find that they only can remeber a limited number of tags, we could add cycling through our known good tags to defeat this.JS

author: RethoricalCheese
author_rank: Newbie
timestamp: April 23, 2024, 12:35:30 pm
content: Tested all 12 of em. All of them are still in memory.Btw, there are 2 typos in slix2_tag_emu 11. Missing a couple commas. Not that it matters to this case.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: April 23, 2024, 06:46:15 pm
content: Quote from: RethoricalCheese on April 23, 2024, 12:35:30 pmWOW... for sure you been busy...So 12 tried means <10 was not the case. I still have some more tag readouts to try. Hopefully something like 16 or 32 is the magic number they implemented.Since they need to "steal" the flash from firmware space and USB stack and the normal printer code needs some space... for sure they only reserved something like 1k - 4k for it.As an absolut minimum they need 4 bytes for the UID and 1 byte fpr the counter which means they could store 200 - 819 UID / counter pairsWorst case... still doable since the bluepill MCU has a lot of empty flash...But it would require a LOT of readouts.Question to all: Is there a firmware "update" available so testing would be easier?JS

author: oztek
author_rank: Newbie
timestamp: April 24, 2024, 05:55:14 am
content: Hi Everyone,We have a Dymo 550 Turbo we purchased as a replacement to a dead older Dymo.It's used as a workshop label printer, as we have a large supply of generic 30252 address labels with removable adhesive, the dymo equivalent are permanent adhesive.Initially we kept using our labels by ripping off the RFID sticker from a genuine roll until the count ran out.I've tried very hard to get this bluepill solution to work and I'm not having any luck. I wondered if I had perhaps bought a counterfeit bluepill board so I bought some more from one of the amazon links posted on this forum to try again.As we are only going to be using 1 label type, the RFID board is not attached.I've used an ST-LINK V2 to flash on the pre-compiled freedmo-default-sku-30252.bin.The process appeared to work successfully, I saw the memory contents change to match the file, and I've tested reconnecting and reading it to confirm it updated.RFID board is removed from the printer and the bluepill plugged in it's place - printer is detected in windows, but when trying to print we still get an unknown label detected error.Can anyone please help, or spot something I've done wrong?Thanks

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: April 24, 2024, 10:29:50 am
content: @oztekThe IC printing "STM32..." looks genuine... But who knows ;-)Please attach a screen shot of the STLink Utility program after you programed the IC (to have a look at base address, ...)JS

author: RethoricalCheese
author_rank: Newbie
timestamp: April 26, 2024, 06:20:28 am
content: Use S0722370 instead of 30252. Both are same size, right?I found that those short model number variants did not work for me but those starting with S do work.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: April 29, 2024, 05:06:05 pm
content: Quote from: RethoricalCheese on April 23, 2024, 12:35:30 pmI have added 5 more SLIX2 UIDs and their signatures for testing.If we're lucky, DMO will only remember the last 16.@RethoricalCheese: Could you please test them as well?In case DMO remembers more than 16, well, then...*W*E*L*C*O*M*E* *T*O* *R*O*U*N*D* *2*Challenge accepted DMO!I just read a very nice write up the other day aboutbreaking STM32 RDP level 2 and level 1protection:https://sec-consult.com/blog/detail/secglitcher-part-1-reproducible-voltage-glitching-on-stm32-microcontrollers/As luck would have it, I have a ChipWhisperer lying aroundSo stay tuned.JS

author: oztek
author_rank: Newbie
timestamp: April 29, 2024, 11:22:53 pm
content: Here's the screenshot from ST Link Utility.I also note the suggestion of trying label S0722370 instead, but I don't see a .bin for that in the package.

author: darkspr1te
author_rank: Frequent Contributor
timestamp: April 30, 2024, 09:31:13 am
content: this is a good read,https://offzone.moscow/upload/iblock/0a5/nad1d86e3ah3ayx38ue56vxbh2j07kd4.pdf

author: RethoricalCheese
author_rank: Newbie
timestamp: April 30, 2024, 01:26:32 pm
content: Sadly even 17 is not enough to roll over.Btw, size should be 2 bytes because some rolls exceed 255 stickers.

author: Zucca
author_rank: Unknown
timestamp: May 01, 2024, 03:50:56 pm
content: Because I know Dymo is reading this.Dear Dymo, why don't you understand you can't win this battle? Stop fighting against your customers who keep your company alive!How is your income doing after you released your DRM dirty trick?Since I know you Dymo will not change soon your "design" strategy, I will make sure my friends and the people I know in my business will not touch any new Dymo product.CEO Sandy Leedon't you think it's time to save your company from an embarrassing end?Hope it will be not too late when you will realize what you have done.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: May 02, 2024, 04:16:36 pm
content: Quote from: RethoricalCheese on April 30, 2024, 01:26:32 pmWas worth a try, thanks for all your testing.Quote from: RethoricalCheese on April 30, 2024, 01:26:32 pmThis is exactly how round 2 will be done... after having a look we will learn how to calculate the unsecured CRC for the data section of the tag.Then we will be able to create tag emulation with 65534 tags on a single spool. Which means the already known 17 UID+signatures could last >1 million prints ;-)We also can remember which UID reported which counter the last time....JS

author: BaronPils
author_rank: Newbie
timestamp: June 23, 2024, 04:21:26 am
content: Does anybody know the sequence of the serial numbers, that we know at least which one the old hack works and for which one the new hack is needed.Maybe for me to startI have a 5XL bought last year which is working: QG1450022xxxAI have a 5XL this year (bought in April) which is not working: QG2350146xxxAI don't share the full serial number, never now who's reading it.Maybe a strange thought, but can we not find a way to flash the firmware of the older 5XL's to the new ones?

author: voltsandjolts
author_rank: Unknown
timestamp: June 23, 2024, 08:47:15 am
content: Quote from: BaronPils on June 23, 2024, 04:21:26 amThat would require the extraction of firmware from the STM32 MCU in the older 5XLs.That's not easy because of security features in the STM32 MCU.But it might be possible, some folks have had success in bypassing those security features, as mentioned above in reply #143

author: ballfanta
author_rank: Newbie
timestamp: July 01, 2024, 11:36:08 pm
content: I purchased my 5XL a while ago, my SN is QG1340XXXXXXA so obviously mine works fine with the hack. It is so disappointing to find that they seem to have actively blocked this.@js_12345678_55AA any further progress on working around dymos latest effort? I can scan my 4x6 labels. I have another 5 rolls that i need to find at the house or i can um scan some at the local supplier. and also thanks for your efforts.Quote from: BaronPils on June 23, 2024, 04:21:26 am

author: BaronPils
author_rank: Newbie
timestamp: July 19, 2024, 07:45:34 am
content: Would the following be possibleAdding bluepill firmware with multiple label-signatures on it.Each restart of the firmware will result in a new label set.Ideally you would only switch labelset when it is empty, but I doubt if this is feasible.If the firmware would store like 30-50x label-ids you would still have like 6-10k labels you can print.For a normal consumer like me this would result in 10years usage.

author: fantasy2
author_rank: Contributor
timestamp: September 03, 2024, 02:10:46 pm
content: If I understand correctly, even with the firmware update, as long as you have a SLIX2_TAG that has never been used before, you can still select any dymo label(match & mix), since the data is separate from the tag ID's? What happens if you use the same tag ID with different data? Does the counter still count down but then for this different label? I wonder why they haven't thought of creating a hash that would include the SLIX2 data and ID.

author: fantasy2
author_rank: Contributor
timestamp: September 06, 2024, 07:39:32 pm
content: I just got a new Dymo 5XL and tore it down since people mentioned that the new 5XL does not work anymore while the old one does.And surprise surprise, the new boards are different.There is now a 128kbit eeprom added to the board. It's a BL24C128A.I'm sure that's where they are storing it now and not inside the STM itself.So.. I wonder what would happen if you keep that IC reset? I wonder if the printer would continue.Would it make sense to read the (unencrypted?) data and figure some more out?Also, I was looking for the IC of the 3volt power supply, but I couldn't find it yet. It's different from the normal 550. I was wondering how many amps it would allow to pull. If we could use an ESP32-C3 to be the middleman, then it would be easy to wirelessly reprogram it with different ID's. But the C3 pulls max 500mA so I was a bit hesitant to try it out.

author: tooki
author_rank: Super Contributor
timestamp: September 07, 2024, 09:53:34 am
content: I would expect that the instantaneous current draw of the printhead and motor are at least as large as the maximum of an ESP32. (Of course, I don’t know whether the printhead and motor are powered from the 3V rail.) Could you just use a little DC-DC converter directly from the DC input in the printer?

author: fantasy2
author_rank: Contributor
timestamp: September 07, 2024, 10:06:21 am
content: Those are both powered from 24Volt. There is a very beefy elco for that.Something plug and play without having to solder something to the dymo would be my preference to make it more widely accessible.The datasheet of the CLRC663(RFID reader) says it uses 350mA while transmitting with a max of 500mA. So there is potential!

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: September 20, 2024, 06:41:47 pm
content: Quote from: fantasy2 on September 06, 2024, 07:39:32 pmBL24C128A = 16kByte EEPROM thats a lot of extra memory to store UIDs and counter values.Looking at the overall security of the device and software I highly doubt they added an encryption layer and even if they might have, than for sure something in ECB mode...So wild guess... emulating the EEPROM from bluepill and replay the empty factory state after each power cycle will most likely solve the problem.And adding a I2C EEPROM emulation to bluepill is just another few lines in the project. Unfortunately one would need to unsolder the EEPROM and add some wires for an emulation to work (no plug and play naymore ;-)Can you make some high res pictures of the PCB?Unfortunately I don't have one of the new printers and I'm not sure how to identify...Maybe we can identify new and old versions with the serial number on the box.I have 2 old versions with following serial number sticker on box:OLD: QE13508005...OLD: QE34400474...BTW: @D*YM*0 ..., since it looks like you read here ;-) WHERE is the new FCC approval for the obviously changed hardwareQuote from: fantasy2 on September 06, 2024, 07:39:32 pmWhy ESP32... Now since even iPhone can do HCE, an Android or iPhone should be able to emulate a NFC-TAG which could be used to communicate with bluepill over the NFC antenna from the spool reader.Just not having enough time is the only limit here ;-)JS

author: ashconnor
author_rank: Newbie
timestamp: September 30, 2024, 01:10:17 am
content: Came upon this thread after buying a 5XL before reading about the DRM. D'oh.I saw a guy is selling a solution on eBay (video below). This one appears to be able to print any label, although it shows an error in the software.Any ideas on how this is being done? I love the fix here (thanks js_12345678_55AA!) but not easily being able to switch labels without a legit tag is a minor drawback.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: September 30, 2024, 12:04:51 pm
content: Quote from: ashconnor on September 30, 2024, 01:10:17 amVery suspicious...SUSPICIOUS EBAY LISTING DO NOT BUY:https://www.ebay.com/itm/266955199429- so why is there a heatshrink covering a PCB which very much looks like a STM32 bluepill ?- why a specific spool type is printed on a sticker on the heatshrink?Smells like a fraudster not respecting the GPL, selling others work...At least we can "learn" something from his ebay listing (even that seems incorrect...):"If it starts with QE2xx ; QF2xx; QG1xx the LabelChip should work. Higher numbers/letter is uncertain, Lower numbers + Letters is Ok."JS

author: ashconnor
author_rank: Newbie
timestamp: October 01, 2024, 11:03:22 pm
content: I had a suspicion he might be ripping you off. Wasn't sure though because his works a little different.

author: RethoricalCheese
author_rank: Newbie
timestamp: November 26, 2024, 01:13:16 pm
content: Quote from: js_12345678_55AA on September 20, 2024, 06:41:47 pmToo bad I haven't looked at this topic for a few months.Thanks for the idea. But I've made it much much easier. Instead of emulating that eeprom, just disable half of it. Bridging pin 7 and 8 with solder will make it read-only

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: November 26, 2024, 08:42:20 pm
content: Quote from: RethoricalCheese on November 26, 2024, 01:13:16 pmGREAT FINDING. GREAT HACK!Do you mind taking and sharing some pictures?JS

author: RethoricalCheese
author_rank: Newbie
timestamp: November 27, 2024, 11:24:18 am
content: Here you go.Tried without your bluepill hack using original labels aswell but it had no effect there. It still decrements on nfc tag. I was just hoping they would have shot in their foot with this moveSo using bluepill hack is still mandatory.Oh and just to explain, it still decrements when using both these hacks but after a power cycle on dymo, it now reverts back to whatever was written on either eeprom or tag, whichever has lower value, it seems.Haven't tested much.

author: fantasy2
author_rank: Contributor
timestamp: November 27, 2024, 11:26:14 am
content: Very nice hack!!Hi Dymo! You are probably still reading here and just got a notification as well.Thanks for this half baked fix.

author: Darxtek
author_rank: Contributor
timestamp: December 05, 2024, 02:59:44 pm
content: are you using the precompiled firmware on the main github?im getting same error but im flashing the old SKU .bins... i did short pin 7/8 but my MB looks different then yours, what model is that?will upload my 550 MB shortly

author: Darxtek
author_rank: Contributor
timestamp: December 05, 2024, 03:11:50 pm
content: 550 turbo motherboard serial # QF3200

author: fantasy2
author_rank: Contributor
timestamp: December 05, 2024, 03:12:50 pm
content: Compile the latest code, test it and let us know. There are parts missing in older code.

author: Darxtek
author_rank: Contributor
timestamp: December 05, 2024, 05:12:10 pm
content: thats where im stuck now lol, trying to compile new firmware now but would i just compile and flash a new main.c file?

author: Axis-3790
author_rank: Contributor
timestamp: December 05, 2024, 06:10:20 pm
content: I just compiled the a new bin file and tested on my patched 550. It is not working for me. When I add the bluepill, the printer refuses to acknowledge the default label defined in the main file. It is not detecting the official dymo labels either. When I remove the bluepill, it works normally.S/N: QF4

author: Darxtek
author_rank: Contributor
timestamp: December 05, 2024, 06:36:50 pm
content: Did you short , pin 7/8 on the eeprom?

author: Axis-3790
author_rank: Contributor
timestamp: December 05, 2024, 06:56:09 pm
content: I did not. Let me give that a go and I will report back.

author: Darxtek
author_rank: Contributor
timestamp: December 05, 2024, 08:35:49 pm
content: sadly not so well with coding or compiling that this is where im stuck. lol

author: Darxtek
author_rank: Contributor
timestamp: December 05, 2024, 08:42:10 pm
content: this is the file im trying to edit

author: fantasy2
author_rank: Contributor
timestamp: December 06, 2024, 11:39:01 am
content: Even without shorting the pins the bluepill should be recognised, but the printer keeps counting down the label and stores it in the eeprom(see earlier posts).If it's not working anymore we would need to see the raw i2c data and see if they do something extra they did not before.

author: Darxtek
author_rank: Contributor
timestamp: December 06, 2024, 11:40:53 am
content: I had to take a break yesterday as my wife was giving me the evil stare because I was stuck in one spot too long but today I will definitely give the firmware a try I was able to properly compile it last night and that’s where I went to sleep lolI’ll have an update in the next few hours

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: December 06, 2024, 01:57:53 pm
content: I updated the pre-compiled binaries on the github project.https://github.com/free-dmo/free-dmo-stm32Release 1.1.0 has a ZIP with pre compiled firmware(s). It now includes the patch for the new D.mo versions.=> You still need to short the eeprom pins (=enable write protect)JS

author: Darxtek
author_rank: Contributor
timestamp: December 06, 2024, 03:33:12 pm
content: shorted EEPROM (at least i think thats the EEPROM) pin 7/8 and wrote reuploaded bin file but still get , blinking power button, stuck on label 30251 (EMPTY)DMO 550 turbo Sr# QF3xxxx

author: Darxtek
author_rank: Contributor
timestamp: December 06, 2024, 03:41:35 pm
content: DMO 550 turboSr# QF3xxx

author: Bastelwastl
author_rank: Newbie
timestamp: December 06, 2024, 09:47:17 pm
content: Hi all,great work js and RethoricalCheese, thanks for your research and effort.I have two Dmos LW 550 (non Turbo) since last week and tried to modify them, they have different Hardwarerevisions, it looks like as if it depends on the Mainboardrevision if the mods are working or not.Dmo 1:LW550B_Rev. H, Date 20220203, Ser. QE2350****BRev. E on NFC Board-> Bluepill +EEPROMmod arenessesary for workingDmo 2:LW550B_Rev. K, Date 20220620, Ser. QE3440****D,Rev. E on NFC Board-> Bluepill is not working, the Dmo didn´t detect the original tunneled labels nor the Bluepills fake labels, blinking all the time, maybe data encryption now.-> EEPROMmod alone is not working, if the EEPROMmod is on, only labels are detected which were put in the Dymo once before the mod. Looks like some kind of "write and verify" of the EEPROM instead of the "stupid" writing and reading the EEPROM like in Rev. H.Hardware changes between Rev. H and Rev. K which i found:- Changed "U2" Stepperdriver for the Transportmotor- Flexconnector for one of the Labelsensors has now three instead five conductorsMaybe others will also share their experience which Revision and Model is working or not.

author: Darxtek
author_rank: Contributor
timestamp: December 06, 2024, 10:12:48 pm
content: Here is a pic of mine….I have some with serial # QF3xxxx and some QF4xxx and both have this same identifier

author: Bastelwastl
author_rank: Newbie
timestamp: December 07, 2024, 12:22:10 am
content: It looks like that the Numbers after the Modelcode (QE=550,QF=550Turbo,QG=5XL) give no hint to the Revision, maybe its the Letter in the End ?My suggestion:QExxxxxB = Rev: HQExxxxxD = Rev: K

author: fantasy2
author_rank: Contributor
timestamp: December 07, 2024, 09:13:42 am
content: Would be great if we could see some i2c raw data from new printers. It would directly clafiry what the issue is. Perhaps the dmo is now doing extra checks and the bluepill does not respond exactly the same way as the original chip. This has happened before.I cannot imagine that the labels are now suddenly encrypted. They would have to encrypt the label the first time it is inserted.If someone can make a dump of the label we can also directly see if this is the case.

author: Xq1xq1xq1
author_rank: Newbie
timestamp: December 09, 2024, 01:47:43 pm
content: I'm new to this but would be happy to get ic2 raw data off the printers I purchased a few months ago.If someone can send me how to this, I gather and send it in to you.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: December 09, 2024, 02:12:17 pm
content: Quote from: Bastelwastl on December 07, 2024, 12:22:10 amThank you so much for this investigation (@Bastelwasti + @Darxtek).I'm now also a proud onwer of a Rev K printer...(serial is in form "QExxxxxD"... so looks like the last letter is the indicator).My original first printer is a "QExxxxxA" which has a "Rev:E" PCB@D.mo: Round 3?JSP.S. From your list...Rev: E, Date 20200812 => initial versionRev: H, Date 20220203 => this date (might be fake) is prior to the discussion in this thread, so they added the eeprom before their problems got discovered? If so it does not contain any direct counter measueres for the bluepillRev: K, Date 20220620 => this date is clearly after they saw (read here) how they screwed up, and most likely they also built a bluepill to test and implement counter measures... (but nothing we should be afraid about...)

author: Darxtek
author_rank: Contributor
timestamp: December 09, 2024, 02:15:59 pm
content: Correct me if I’m wrong but I think yesterday somebody posted some raw data but it looks like it is deleted now. Sadly all my printers are Rev: I

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: December 09, 2024, 09:48:53 pm
content: Quote from: Bastelwastl on December 06, 2024, 09:47:17 pmI did some initial tests with my revision K:* I added the bluepill with latest firmware (see "1.1.0" release on github)* no EEPROM write protect for now* stuffed in some generic labels (without RFID)* turned printer on and it shows a steady ready light* hold middle button for some time for deep sleep, press middle button again to wake up ==> still steady light* flashed another (label) firmware, restarted ==> also ready light* flashed another (tag emu) firmware, restarted ==> also ready light@Bastelwastl ...Please make sure you test with the latest 1.1.0 firmware:https://github.com/free-dmo/free-dmo-stm32/releases/tag/v1.1.0We also could face different firmware inside of the printer's MCU.Tomorrow I will hook up the logic analyzer and listen to I2C reader and I2C eeprom while doing some "original prints"JS

author: Bastelwastl
author_rank: Newbie
timestamp: December 09, 2024, 10:46:43 pm
content: QuoteIt was me, after comparing my posted "raw data" to others raw data, i saw it was only bull***t my homebrew "sniffer" spit out. So i decided to delete the confusing posting.Quote"Sherlock JS"you were absolutly right, I desoldered the EEPROMmod now in Rev: H and its also working (i did the EEPROMmod & Bluepillmod together without crosscheck). Maybe they only changed the Type and Brand of the EEPROM in this Revision.I will attach an updated list.@Darxtek, can you post the last Letter in your Dmo Serial?@RethoricalCheese, can you also post your Dmo Revision and Serial?

author: Axis-3790
author_rank: Contributor
timestamp: December 09, 2024, 10:49:47 pm
content: I apologize for the delay on my end. I ended up busier than expected last week. I did go ahead and attempt to solder pins 7&8 on the eeprom. Feel free to refer to my picture to make sure I did it right. I also compiled v1.1.0 onto the blue pill. I am using label 30347 but with no success. It did not detect the official dymo branded labels either.S/N version QF4*********CRevision I

author: Darxtek
author_rank: Contributor
timestamp: December 09, 2024, 10:58:08 pm
content: These QF3 and QF4 where both RevI for me

author: Bastelwastl
author_rank: Newbie
timestamp: December 10, 2024, 12:34:31 am
content: @JS, I did some short tests with your new release on Rev: K, flashed "freedmo-default-sku-S0722530", Bluepill with labelsize is detected and the labels are count down during printing but no counter reset after powerup, so its defenatly written to the EEPROM. Original labels are not detected / tunneld now.Then I flashed "freedmo-default-sku-S0904980.bin", Bluepill is working, Dmo has steady light with every label and shows "empty" in the Software but i can print any label and size, whatever I want, no countdown, no labelsize is shown in the software.But the Bluepill freezes with "freedmo-default-sku-S0904980.bin" after two minutes or so, green LED stays on, Dmo is blinking. After a press on the resetbutton everything is working again in the same matter until next freeze.

author: RethoricalCheese
author_rank: Newbie
timestamp: December 10, 2024, 09:44:31 am
content: SN: QE3*********DRevision Kwas the one I was testing on. (hoping I did not get my boards and cases mixed up at one point)Just to clarify to people trying the short method. If you can't even get the bluepill hack working then shorting gives you nothing but wasted hours. You must first get the bluepill hack working (detecting the label coded in your bluepill) and only after that try shorting.All shorting does is preventing writing label information to dymo itself.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: December 10, 2024, 06:27:50 pm
content: Quote from: Bastelwastl on December 10, 2024, 12:34:31 amThis sounds like a JOKER ? I will test this nextJS

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: December 10, 2024, 07:22:33 pm
content: Quote from: Bastelwastl on December 10, 2024, 12:34:31 amFound a bug in NXP SYSINFO READ REQUEST, so tunneling labels does not work in 1.1.0JS

author: Bastelwastl
author_rank: Newbie
timestamp: December 10, 2024, 09:31:33 pm
content: Quote from: js_12345678_55AA on December 10, 2024, 06:27:50 pmThis label normally is for the Dmo XL Version, maybe its not present in the Firmware or EEPROM of the Dmo 550 and therefore it behaves like this. I flashed "freedmo-default-sku-S0904980.bin" from Release 1.1.0 again, and the freezing issue is gone.Printed 75 aftermarket labels (no NFC) with EEPROM write protect on and 50 labels with EEPROM write protect off (i put a Switch between pin 7 & 8 ) without a problem.Does the bluepillhack with release 1.1.0 actually work for one of the 550 Turbo owners with Rev: I ?

author: Axis-3790
author_rank: Contributor
timestamp: December 11, 2024, 09:43:39 pm
content: 550 Turbo w/ rev I here. I have two of them to be specific. I have one with the eeprom pins 7 & 8 soldered together and the other is normal. I downloaded the v1.1.0 again today and compiled the software again. Both 550 turbo's did not recognize the official dymo labels. Both started flashing after booting.

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: December 12, 2024, 03:01:02 pm
content: Here comes a small I2C christmas storyBL24C128A = I2C eeprom with 256 pages a 64 bytes + 1 extra id page ==>https://www.belling.com.cn/media/file_object/bel_product/datasheet/BL24C128A.pdfD.MO pcb pulls all address lines to GND which make I2C address of the eeprom 0x50In order to read from a specific address an incomplete write (just sending the address and then stop) needs to be performed.At startup D.MO printer reads in 8 byte blocks starting at page 1 (address 0x0040).write to 0x50 ack data: 0x00 0x40read to 0x50 ack data: 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFFread to 0x50 ack data: 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFFread to 0x50 ack data: 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFFread to 0x50 ack data: 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFFread to 0x50 ack data: 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFFread to 0x50 ack data: 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFFread to 0x50 ack data: 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFFread to 0x50 ack data: 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFFread to 0x50 ack data: 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFFread to 0x50 ack data: 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFFread to 0x50 ack data: 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF==> Factory default is empty (everything is 0xFF)At the moment a new spool is inserted into the printer the following WRITE happens:write to 0x50 ack data: 0x00 0x40 0xFF 0x01 0x16 0x7B 0x77 0x55 0xC6 0xFFwrite to 0x50 nakwrite to 0x50 nakwrite to 0x50 ack data: 0x00 0x00read to 0x50 ack data: 0xFFTranslation:- write to I2C device 0x50, to address 0x0040- try to start a new write => NAK (polling to find if eeprom is still busy with the write)- try to start a new write => NAK (polling to find if eeprom is still busy with the write)- try to start a new write @0x0000 => ACK (polling found out eeprom is not busy with write anymore)- read (from 0x0000) ==> 0xFF (makes no sense... but maybe this was the "easy" way to cancel the previous write)Let's have a look at the written data (8 bytes):0xFF 0x01 0x16 0x7B 0x77 0x55 0xC6 0xFFFIX? FIX? UID UID UID UID CNTR CNTRSo it looks like the 8 bytes are composed as follows:0xFF 0x01 fixed (same for all records, I added more later)0x16 0x7B 0x77 0x55 UID (lower 4 bytes of the slix2 tag UID)0xC6 0xFF counter (last seen counter value for this slix2 tag UID)!AFTER THE EEPROM WRITE THERE IS NO READ / VERIFY OF THE JUST WRITTEN DATA!==> hardware write protect will work 100%And just in case there is a check, we could solder 2 wires from resistors next to I2C eeprom to the bluepill and...a) whenever bluepill starts up we could ERASE the eeprom (to factory defaults)b) emulate the eeprom completelyWhenever printer is turned on / comes back from standby / spool is changed, a read starting from address 0x0040 is initiated...... as soon as the UID from the currently inserted tag is found the read stops... it also stops after reading several? empty entries (8 times 0xFF) - looks like it stops as soon as the first eeprom page is read which starts with 8x 0xFFI will now "clean up" my eeprom, add the "solder blob write protect" and then focus on making everything work again ;-)JSSo for testing you should:- make eeprom write protect FIRST- then pick a never used SLIX2 TAG EMU (e.g. 17) and compile firmware with it (this ensures that your eeprom does not have UID from tag emulation stored with a low or locked counter)#define SLIX2_TAG_EMU 17(tag pass through does not work yet, will be fixed soon).

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: December 16, 2024, 09:18:21 am
content: I never paid attention to this detail...but now that I looked closer. It seems my REV. E board also has a I2C eeprom (U5: ATH102... might be ATMEL part).I wonder if the feature was there all along and some sloppy developer just forgot to enable it in the older firmware?JS

author: Bastelwastl
author_rank: Newbie
timestamp: December 16, 2024, 02:43:21 pm
content: The ATxyz EEPROM from Rev: E has imho only 2Kbit instead of the 128Kbit from Rev. H & Rev. K.https://ww1.microchip.com/downloads/aemDocuments/documents/OTH/ProductDocuments/DataSheets/AT24C01D-AT24C02D-I2C-Compatible-Two-Wire-Serial-EEPROM-1Kbit-2Kbit-20006100A.pdf

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: December 16, 2024, 04:21:25 pm
content: Quote from: Bastelwastl on December 16, 2024, 02:43:21 pmI will have a look later... maybe used for serial numberWTF... there is *ALWAYS* enough space inside of the STM32 to store 2kBit = 256 BYTE !!!.JS

author: js_12345678_55AA
author_rank: Frequent Contributor
timestamp: December 16, 2024, 04:24:27 pm
content: Meanwhile I created a new release (v1.1.1 on Github) which should fix the pass through problem introduced with v1.1.0.=>https://github.com/free-dmo/free-dmo-stm32/releases/tag/v1.1.1Next few days I should have some more time to check everything with my 550 Rev. K.JS

author: Axis-3790
author_rank: Contributor
timestamp: December 18, 2024, 11:05:37 pm
content: Rev I550 Turbo QF4I have tested v1.1.1 and it is showing improvement compared to the previous version. It will now detect official dymo branded labels w/ the bluepill. No flashing lights. It did not take the default 30336 label when I tried testing an after market roll.

author: Bastelwastl
author_rank: Newbie
timestamp: December 23, 2024, 06:35:23 pm
content: @JS, thanks for the early x-mas present, works fine@Axis-3790, did you try to flash another precompiled .bin from the v1.1.1 ZIP File?

author: Axis-3790
author_rank: Contributor
timestamp: December 23, 2024, 11:16:33 pm
content: I did not use a precompiled. I have been compiling my own firmware via WSL everytime. I can use a precompiled firmware if that is the recommended method.

author: lemonotype
author_rank: Newbie
timestamp: December 30, 2024, 05:11:14 pm
content: Hello everyone!I signed up to:1. Thank everyone involved for doing god's work and letting me use a machine I paid for as I see fit.2. Report my experience / findings as I didn't see them outlined here exactly.Here's how it went:1. I bought the machine (5XL) mid-December off Amazon, flashed 1.1.1 on Bluepill and it immediately worked fine.2. A day or two (and less than 10 labels) later it started showing up as empty on Dymo software.3. Theonlyway to get it to print was to send labels to print, get the empy error, then turn it off and on, it would print all labels then start flashing again.4. Today I decided to dig up a solution, found this thread, opened it up again and looked for the two pins to short... but the chip wasn't there.5. I found it hiding on the bottom of the board, joined the pins, and the printer has correctly been reporting 219 labels and online for a few hours now... fixed?PCB says RevDAdding a couple photos, maybe it's useful to someone, thanks again and... see you next time it stops workingEDIT: Welp the issue came back again, guess I'll lurk around and wait for a fix lol.EDIT2: Actually uhh it seems to be working fine now, so maybe the write protect did the trick after all.

author: Cali250402864
author_rank: Newbie
timestamp: December 31, 2024, 06:44:35 pm
content: Forgive me for the stupid questions... I recently fell into the Dymo 550 trap. From what I understand from this thread, the hack requires modification to the hardware in order to modify the code/program?Is it possible to clone the NFC code onto blank tags? Has anyone tried yet?

author: Axis-3790
author_rank: Contributor
timestamp: December 31, 2024, 10:40:00 pm
content: This thread is related to a bypass of reading the chip on the 550's. It is through the method of installing an STM32 board between the NFC reader and the main board. You do not necessarily "modify" the hardware but add to it. The STM32 is emulating the chipped labels and just modifying the label count on the NFC. I believe we cannot clone the NFC onto a blank one due to the label count being stored in the dymo itself. I highly recommend reading through the 9 pages of this thread if you are wanting anymore info. I am just another user who is thankful for the bypass as the cost of labels is a literal 10x price difference.Github w/ instructions on what to do:https://github.com/free-dmo/free-dmo-stm32

author: Fara
author_rank: Newbie
timestamp: January 12, 2025, 06:20:17 pm
content: Received a new Dymo 5XL.PCB rev: IDate: 20221017Different EEPROM (BL24C128A), located on the front.As I understand, legs 7 and 8 should be connected for WP mode, right?

author: voltsandjolts
author_rank: Unknown
timestamp: January 12, 2025, 06:34:08 pm
content: Quote from: Fara on January 12, 2025, 06:20:17 pmCorrect.So, just to be clear, solder blob where the red dot is on attached image.

author: Axis-3790
author_rank: Contributor
timestamp: January 14, 2025, 10:48:02 pm
content: Let me know if this works for you. I have a Rev I and I attempted to solder 2 legs together with no success.

author: Pardini
author_rank: Newbie
timestamp: January 23, 2025, 06:16:32 am
content: 4 more readouts from me...

author: Fara
author_rank: Newbie
timestamp: January 29, 2025, 02:33:02 am
content: Quote from: Axis-3790 on January 14, 2025, 10:48:02 pmI can confirm that the hack works on the Rev. I board.It does not want to simulate the tags/rolls. So it only works with real tags but resets the number of labels left after power down. So more than enough for me.

author: Pardini
author_rank: Newbie
timestamp: January 30, 2025, 03:16:14 am
content: Quote from: Fara on January 29, 2025, 02:33:02 am@Fara have you write-protected the EEPROM on the motherboard with the solder blob method on pin 7/8? Or does it work without modification to the mainboard?

author: Fara
author_rank: Newbie
timestamp: February 05, 2025, 02:22:05 am
content: Quote from: Pardini on January 30, 2025, 03:16:14 amYes, it works only with the write protection.

author: AKRUA
author_rank: Newbie
timestamp: February 05, 2025, 05:15:15 pm
content: Howdy yall, im new to STM32 stuff, and hardware mods, my work has a couple dmo 550 turbos, im trying to setup the bluepill for it. when i flash the firmware to it, it seems to be successful, but when i plug it into the printer, the light on the printer just flashes. Sometimes, the light on the printer will be solid for a couple minutes, but as soon as you try to print or do anything, it will just start flashing. I am not using the original RFID board pass through, and am just trying to emulate labels. I have also added the solder blob on the main board of the printer to add the write protection. Any suggestions or guidance wopuld be greatly appreciated. Thank you.

author: Axis-3790
author_rank: Contributor
timestamp: February 06, 2025, 06:09:23 pm
content: Quote from: AKRUA on February 05, 2025, 05:15:15 pmWhat board revision do you have?

author: AKRUA
author_rank: Newbie
timestamp: February 06, 2025, 06:33:06 pm
content: I know the last digit of the serial number in the printer is a C, but im not sure how to find the board revision. How would i find that?

author: Axis-3790
author_rank: Contributor
timestamp: February 07, 2025, 02:55:53 pm
content: Quote from: AKRUA on February 06, 2025, 06:33:06 pmIt is on the board itself. You can see an example on some of the pictures on this thread. Some users have posted pictures of their boards. You will see a section that looks like it has a QR code and below that you will see a revision abreviated to Rev. (letter).For example, I have Rev. IIf you follow the thread, you will see users have posted a handful of revisions that are working for them.

author: AKRUA
author_rank: Newbie
timestamp: February 07, 2025, 03:09:16 pm
content: It is a rev I

author: Axis-3790
author_rank: Contributor
timestamp: February 07, 2025, 07:08:16 pm
content: Quote from: AKRUA on February 07, 2025, 03:09:16 pmSupposedly you can use the blob of solder on the pins to reset the label count on official labels but I have yet to get emulation to work on Rev I boards. I have 2 dymos that are Rev I. I am awaiting an update to see if we can get emulation to work on Rev I.

author: AKRUA
author_rank: Newbie
timestamp: February 07, 2025, 07:10:09 pm
content: Quote from: Axis-3790 on February 07, 2025, 07:08:16 pmDoes it need to pass thorught the STm32 or can i just use the original hardware with the solder blob?

author: AKRUA
author_rank: Newbie
timestamp: February 12, 2025, 07:27:23 pm
content: Ok, so i have the printer set up with the pass through, and the solder blob write protection, i have a precompiled bin flashed to the stm32, my board is a REV I so i have a dymo rfid tag on the reader.I no longer am getting the "out of labels" error, but am now getting a "unknown label type detected"Do i need to re flash the stm32? Do i need to compile my own binary? Im kinda lost here.

author: Axis-3790
author_rank: Contributor
timestamp: February 13, 2025, 04:28:24 pm
content: Quote from: AKRUA on February 12, 2025, 07:27:23 pmI have been waiting over a month for another update on this. I believe Rev I is the problem board now. The only idea I have now is to get a different Dymo for a different version board. Maybe go on eBay to find someone who is angry with their older 550 turbo. Otherwise you might be here stalking the forum every few days like me

author: AKRUA
author_rank: Newbie
timestamp: February 13, 2025, 05:07:43 pm
content: Quote from: Axis-3790 on February 13, 2025, 04:28:24 pm

author: AKRUA
author_rank: Newbie
timestamp: February 13, 2025, 05:09:21 pm
content: Quote from: Axis-3790 on February 13, 2025, 04:28:24 pmHave you got the pass through to work? I have a few dmo label rolls that I can use for the rfid if I can just find a way for pass through to work

author: Fara
author_rank: Newbie
timestamp: February 17, 2025, 08:13:26 pm
content: Quote from: AKRUA on February 13, 2025, 05:09:21 pmMy bluepill works only in a pass-through mode and I have the same rev I board.To your previous question, as I understand, the EEPROM has a counter and it backs up the counter on the RFID chip. So you need to have both the pass-through mode and the writing protection enabled on EEPROM. Funny, it would stick to the number at which you put the WP mode. Better making it on a full roll. Mine now stuck at 20 labels left.Regarding to the issue that you have, it is hard to debug by just looking at the printer's LED.The counter is more or less independent from the chip validation. So if you don't have chip confirmed, you would not get to the counter.I would suggest to return the status of the bluepill to the UART and maybe even dump the data from I2C to UART.

author: AKRUA
author_rank: Newbie
timestamp: February 17, 2025, 08:16:25 pm
content: Would compiling my own binary possibly be beneficial to me rather than using a precompiled binary? Or would that not effect how the pass through works?

author: Fara
author_rank: Newbie
timestamp: February 19, 2025, 01:28:30 am
content: Quote from: AKRUA on February 17, 2025, 08:16:25 pmThe pass-through mode turns on when a real tag is presented to the RFID reader. You don't need to recompile the code for that.You would need to recompile only if you want to change the code (e.g. adding the UART logging).There are different binaries available for different simulated tags. I don't remember what happens when you have a conflicting roll type in the binary and in your real tag. So make sure, the roll type/size is correct.Also, make sure your real tag is close enough to the RFID reader. It should be within ~20 mm.Also, I think the easiest part to screw up is the wiring. Make sure you have the right resistors and wiring.Ah, another thing I noticed. The printer is blinking if anything is wrong. Including other cables. Make sure you have connected all the cables. Make sure the paper also has holes similar to the original and the paper is pushed forward.

author: AKRUA
author_rank: Newbie
timestamp: February 19, 2025, 02:22:22 am
content: I should mention, i am looking at the print queue in windows to see what the error state is, which is where im getting the "unknown label type" message

author: sp7dpt
author_rank: Newbie
timestamp: February 19, 2025, 06:21:51 pm
content: @js_12345678_55AA Hi, I have a printer with a Rev. E board.I programmed the Bluepill new release (v1.1.1):freedmo-default-sku-S0722530: the label is detectedfreedmo-default-sku-S0722560: the label is detectedfreedmo-default-sku-S0722540: the label is not detected, but the LED in the printer does not blink. It shows a blank label with no counter. After manually selecting the label, printing is possible.Other random labels are also not detected automatically.Is there anything I can do about this?

author: Axis-3790
author_rank: Contributor
timestamp: March 25, 2025, 02:15:24 pm
content: Is this thread dead now? I was really hoping we could get a resolution on the REV I board. I have 2 of them and I know others are have them as well. I am not sure of the process to looking into this but I am resourceful if anyone has any leads. I would love to contribute. I am just not sure where to start.

author: Bastelwastl
author_rank: Newbie
timestamp: April 22, 2025, 09:47:06 pm
content: Hello everyone,with the newer board revisions with large EEPROM, I discovered that every new label SKU that isn't yet stored in the EEPROM must be saved to the EEPROM once. Otherwise, the DMO will flash, and you'll get an error message in the program.This means you have to disable the read-only-mode (remove the solder blob on the EEPROM, it's better here to solder in a switch , two wires that can be twisted together or similar).Insert the unknown original label you want to learn to the DMO or the unknown SKU from the bluepill, turn on the DMO (DMO shouldn't blink with read-only disabled), print a test label, turn off the DMO, and switch back to read-only mode (solder blob or similar). This has to be done with every unknown SKU.For those who new install the bluepill to their DMO, install first the bluepill with the choosen SKU, print one or two bluepill-emulated-labels, if this works thenenable/ switch on read-only-mode on the EEPROM, one step before the other results in a non working flashing DMO (if the label SKU is not in the EEPROM).

author: kko
author_rank: Newbie
timestamp: June 24, 2025, 05:52:28 am
content: Quote from: Bastelwastl on December 07, 2024, 12:22:10 amQExxxxxB == Rev K tooIt depends on number inside i think

author: kko
author_rank: Newbie
timestamp: June 24, 2025, 05:57:22 am
content: Quote from: js_12345678_55AA on December 16, 2024, 04:24:27 pmIs there any updates about LW550B_Rev. K (QE**********B)?Anyone runs free-dmo on rev. K?I am ready to pay for a working solution, maybe we can offer a donation to make it more interesting for everyone to do this? I have 300 US dollars at the start.