Project:RELaserSoftware: Difference between revisions

From London Hackspace Wiki
 
(49 intermediate revisions by 8 users not shown)
Line 1: Line 1:
[[File:Caution_reversing.jpg|250px|right]]
==Reverse Engineering Laser Software==
==Reverse Engineering Laser Software==


The [[Equipment/LaserCutter|laser]] software is bad, we need to know about the file that is created by it so we can create our own in some fashion. Also if it does anything fancy when it downloads itself via USB.
The [[Equipment/LaserCutter|laser]] software by Leetro is bad, we need to know about the .mol file that is created by it so we can create our own in some fashion. Also if it does anything fancy when it downloads itself via USB.


==Background==
==Background==
Line 8: Line 9:
There is a special patched version that cannot currently (but hopefully one day) will be useful for exploring .mol files on babbage in EB4890's folder.
There is a special patched version that cannot currently (but hopefully one day) will be useful for exploring .mol files on babbage in EB4890's folder.


* [http://www.leetro.com/english/Down/54.html Manual for the MPC6515 controller] (uses [http://en.wikipedia.org/wiki/Modbus Modbus] over serial)
* [http://www.leetro.com/english/Down/54.html Manual for the MPC6515 controller] (uses [http://en.wikipedia.org/wiki/Modbus Modbus] over serial for the control panel)
: Note that this says there's software bounds protection with firmware versions 4.1.0.0 or above (once origin is set)
: Note that this says there's software bounds protection with firmware versions 4.1.0.0 or above (once origin is set)
* [http://www.leetro.com/down/54.html Firmware for MPC6515 controller] (and LaserCut software again)
* [http://www.leetro.com/down/54.html Firmware for MPC6515 controller] (and LaserCut software again)
: the firmware is in the "And tools update" .rar file
:[http://translate.google.com/translate?js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&sl=zh-CN&tl=en&u=http%3A%2F%2Fwww.leetro.com%2Fdown%2F54.html&act=url the above, translated by google]
:[http://translate.google.com/translate?js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&sl=zh-CN&tl=en&u=http%3A%2F%2Fwww.leetro.com%2Fdown%2F54.html&act=url the above, translated by google]
* [http://www.solustan.com/linkmotion_and_leetro.php A commercial printer driver compatible with the MPC6515]
* [http://www.solustan.com/linkmotion_and_leetro.php A commercial printer driver compatible with the MPC6515]
: Has comments on the .ini file settings
* [http://wenku.baidu.com/view/1af68b3283c4bb4cf7ecd15f.html Documentation for the MPC03] (previous version, we're MPC05) with .ini file info
* [http://focus.ti.com/docs/prod/folders/print/tms320vc33.html DSP chip] and [http://focus.ti.com/docs/toolsw/folders/print/c3xfreetool.html compiler].  [http://www.google.com/search?q=TMS320C31 See also], [http://www.elec.canterbury.ac.nz/c4x/ GDB toolchain]. These chips are end-of-line, but were supported by GCC up to [http://gcc.gnu.org/gcc-4.3/changes.html 4.2].


==Initial Analysis of .mol file==


Looking at: <tt>/Solexious/MarioBoxes/MINIMARIO.MOL</tt>
== Current State of work ==


No ASCII strings (looking using strings)
We have:


Does not appear to be compressed (too many zeroes)
* Some knowledge of the .MOL format
* A [https://github.com/londonhackspace/txt2mol .TXT to .MOL compiler] based on the DLL (runs under Wine)
** There are headers for this file online, [http://read.pudn.com/downloads184/sourcecode/windows/862584/Line/mpc03ls.h__.htm mpc03ls.h] and [http://google.com/search?q=%22mpc05ls.h%22 mpc05ls.h]
* A [https://github.com/londonhackspace/dumpmol .MOL parser] using python and construct
* [http://pointless.net/hg/mpc6515/ USB driving software] that allows us to tell the laser cutter to run box, etc.


* <tt>0x000</tt> : Header
== Currently to do ==
* <tt>0x200</tt> : One set of information What?
* <tt>0x400</tt> : Another set of information.
* <tt>0xa10</tt> : Likely co-ordinate data. Quite repetitive. Analysis document was mario boxes, with many repetitions of sub boxes, so that makes sense. It looks like possible 16bit number co-oords as the numbers range from a few thousands to hundreds. 32bits are in unrealistic ranges (huge in negative ranges).


==To Do==
* Figure out DXFs - <span style="text-decoration:line-through;">A [http://pypi.python.org/pypi/DXF-Converter/1.0/ python to dxf to pdf converter] might be useful</span>. It seems to have got swallowed by by gaping maw of broken links. I've not found a stand alone parser.
* Figure out which parts of the TXT file correspond to which function calls, so we know how to generate meaningful TXT files.
* More work on .Mol files?


Create simple .mol files with slight changes in
==Initial Analysis of .mol file==
 
* One co-ordinate of a point
* The colour of one line
* The speed of one colour
* The power of one colour


And find diffs.
See [[Project:RELaserSoftware/MOL file format|MOL file format]] for description of MOL file format


==USB==
==USB==


Vendor: 0548
See [[Project:RELaserSoftware/USB protocol|USB protocol]] for description of the upload/download protocol.
Product: 1005
 
The protocol seems to be fairly simple. I have a capture of some file downloads and deleting a file.
 
looks like:
 
commands are sent to endpoint 0x04 and read form 0x88, sent commands are (byte)length and then length bytes
 
commands 5 and 6 seem to be start and end
 
example command block:
 
<pre>
>w04 0002    00000000: 01 05
*r88 0001    00000000: 04
>w04 0006    00000000: 05 01 01 83 01 7a
*r88 0001    00000000: 06
*r88 0001    00000000: 05
>w04 0002    00000000: 01 04
*r88 0014    00000000: 0f 01 83 53 51 55 41 52 45 20 20 4d 4f 4c 00 0e
    00000010: 00 00 00 66
>w04 0002    00000000: 01 06
</pre>
 
That last reply packet includes the ascii for 'SQUARE  MOL' with two spaces in the middle to pad it to 11 characters. This must be a file name in DOS 8.3 format with the . implied between the 8th and 9th characters.
 
This presumably maps directly to a [http://en.wikipedia.org/wiki/File_Allocation_Table#Directory_table FAT16 entry], so don't let it be null or begin with a dot!


==Random Links that may be useful==
==Random Links that may be useful==
Line 74: Line 49:
*  http://www.rabbitlaserusa.com/DriverDisk/MPC03/MPC03LV3030/MPC03-LV%203.0.3.0/
*  http://www.rabbitlaserusa.com/DriverDisk/MPC03/MPC03LV3030/MPC03-LV%203.0.3.0/
*  http://www.rabbitlaserusa.com/0/
*  http://www.rabbitlaserusa.com/0/
* [https://www.ribbonsoft.com/rsforum/viewtopic.php?f=30&t=2436&p=7965 MOL file import script for QCAD]
== Driver ==
Works for VID 0548, PID 1005.
Description of the device is EZ-USB (68013A), which is basically a serial interface.
[[Category:Projects]]
[[Category:Infrastructure]]

Latest revision as of 20:07, 9 October 2014

Caution reversing.jpg

Reverse Engineering Laser Software

The laser software by Leetro is bad, we need to know about the .mol file that is created by it so we can create our own in some fashion. Also if it does anything fancy when it downloads itself via USB.

Background

The software is available here. Please scan this with antivirus software before use.

There is a special patched version that cannot currently (but hopefully one day) will be useful for exploring .mol files on babbage in EB4890's folder.

Note that this says there's software bounds protection with firmware versions 4.1.0.0 or above (once origin is set)
the firmware is in the "And tools update" .rar file
the above, translated by google
Has comments on the .ini file settings


Current State of work

We have:

Currently to do

  • Figure out DXFs - A python to dxf to pdf converter might be useful. It seems to have got swallowed by by gaping maw of broken links. I've not found a stand alone parser.
  • Figure out which parts of the TXT file correspond to which function calls, so we know how to generate meaningful TXT files.
  • More work on .Mol files?

Initial Analysis of .mol file

See MOL file format for description of MOL file format

USB

See USB protocol for description of the upload/download protocol.

Random Links that may be useful

Driver

Works for VID 0548, PID 1005. Description of the device is EZ-USB (68013A), which is basically a serial interface.

Retrieved from ‘https://wiki.london.hackspace.org.uk/w/index.php?title=Project:RELaserSoftware&oldid=43313’