Hacking the XYZ Davinci Jr.

If you purchased the Davinci Jr over the holiday season, or received one as a gift, you may have been surprised to find out that you have to buy XYZ filament. The salesman at Barnes and Noble was telling people you could buy any filament, which is obviously not the case. This post is to document my progress hacking the Davinci Jr.

I started doing a little research to see what other people have found out about the machine so far. There was a thread at SoliForum where people had found some information and dumped the password protected contents of the NFC chip used in the XYZ filament rolls. XYZ uses NTAG213 chips and a PN512 reader chip. My first thought was, "How are they passing the password to the NTAG213?". I couldn't find anything in the datasheet on the PN512 to indicate it supported passing encrypted data to the NFC chip so I assumed it was receiving the password in plain text from the printer. I pulled the left side cover from the printer to get a better look at what was going on with the NFC board.

Left side removed. Arduino and Saleae Logic 4 hooked up to PN512 board.

Close up of PN512 board removed from XYZ Davinci Jr.

Based on the data sheet for the PN512 and checking the board with a multimeter, the pinout  of the connector on the board was : 1. 3.6V, 2. GND, 3. NRSTPD, 4. IRQ, 5. SDA, 6. SCL.

Again, based on the datasheet it was wired for I2C. I hooked up the Saleae Logic 4 I had recently purchased and started capturing information.

Saleae Interface

Now looking at the datasheet for the NTAG213, the password authentication command is 0x1B. I typed that in the Saleae search box and found where that command was being written to the command register on the PN512 to be passed to the NTAG213. The next 4 bytes were the password for the chip: 0x22 0x66 0x52 0xC6.

Here is part 2 with information on using the password grabbed here.