Reversing and repurposing a resin 3D printer

About

Goran

Repair technician for informatics equipment

Repair technician for banking equipment

SW/HW design engineer (LoRa, NB-IoT, FPGA...)

Member of Radiona.org – Zagreb Makerspace

Meetups, lectures, workshops, exibitions...

CEO and co-founder of Intergalaktik d.o.o.

About

Igor

Software and hardware developer

Maker

Member and co-founder of Radiona.org – Zagreb Makerspace

Founder @ HYPERGLITCH Ltd

@1g0rb

About RadionaOrg

Radiona.org is a non-profit organization and citizen lab consisting of makerspace/hackerspace, media art lab, Repair Café and residence program founded in 2011. The organization is dealing with DIY (do-it-yourself), DIWO (do-it-with-others) and DITO (do-it-together) cultures, STEAM concepts, interdisciplinary and inter-generational non-formal education and hybrid activities.

It is a diverse community of different professions working together.

It all started with simple task

Could you create low budget machine that will be used for measuring displacement sensors?

Those machines usualy cost over 10k € and they do more then I need.

But I just need to move motor for 0.1mm and take measures to confirm how sensor will react in different conditions.

https://www.hans-schmidt.com

Industrial grade

Put sensor on any of Prusa axes.
Send G-CODE to printer to move to new location.
Use SCPI to get voltage from multi-meter.
Calculate displacement.
Refresh graph and gauges.

Those tasks are a piece of cake for Envox EEZ Studio
(open source) Croatian (Zadar/Zagreb) project

Let's use Prusa instead

Envox EEZ Studio

Final working setup

PoC - confirmed!

But what about resin printers?

Even cheap resin printers are precise up to 0.01mm.

They look almost the same as those 10k € industrial tools.

I can just buy one, and use the same G-CODE with the same setup!

My plan collapsed!

Controlling this printer with GODE works.

Printer only has a USB host for USB stick.

Serial over WIFI should work, but I have checked each serial port directly and it was not responsive.

I have tried few more simple things but nothing worked!

I was stuck!

And if you're stuck you need to search if maybe someone else did something with those printers.

Let's check what is inside!

There's an impressive write up on hacking Mono 4K on GitHub:

https://github.com/nviennot/reversing-mono4k

This was extremely helpful for my work

I first tried to compile the firmware – as it would be perfect to just build up on existing code.

Open Firmware for Mono 4K is written in Rust and I was not able to compile it on my Linux.

But! I could just use the write-up and start (almost) from zero!

Mono 4K board is almost the same as Mono 6Ks except the 6Ks has a GigaDevice GD32F427 MCU

Pinout is different so I need to get the board out and check out the physical connections.

Do not tell anyone!

Who would've guessed that GigaDevice GD32F427 is a clone of STM32F427

ST has superior toolchain and, as I need fast results, I'll try if the ST tools will work with this device!

Spoiler Alert!

Same FW works on both chips!

So I can continue with CubeMX generated code!

Authors also created a simulator!

As I was reading the write-up I noticed that authors also created a simulator for resin printers.

Simulator can run binaries and have some of the printer's peripherals – running that simulator could help me in finding the correct pinout for the display.

But once I ran the simulator with everything it just stopped...

(later I discovered that was because of missing peripherals which I can add by applying some patches)

To know exactly what to do we will also need Ghidra

Ghidra and SVD loader

Tools did not help

As I could not reach the authors, and I am not usually doing reverse engineering, I was not able to find out FMC screen pinout.

So I tried to do it manually...

We have a picture!

Almost done!

One more stupid thing on this printer is that touch sense is using SoftSPI so I needed to rewrite the touch sense driver.

After that I spend some time in getting LVGL working. After I got it to work, I had Envox EEZ GUI on board in no time!

Motor driver was also easy and I have used the one from IRNAS:

https://github.com/IRNAS/AccelStepper

And now I have everything I need for my displacement machine!

https://www.youtube.com/watch?v=ttDBSPXaT3Y

Back to the tools!

Now I do have everything for my machine, but it would be great to get the big Mono LCD to work as I could also make a completely open source printing firmware.

Big Screen is connected to FPGA through MIPI

FPGA has SDRAM

GD32 is sending commands to FPGA which controls the screen

Buy faster equipment

Need for speed!

Catch me if you can!

Applying patches in emulator!

Once emulator stops Ghidra can be used to check that address

asm.py can then be used to convert the assembly to jump or NOP

Then just add that patch to the emulator and it will run the patched firmware

Let's ask ChatGPT

Found a divider setup!

After some time I found where the SPI clock divider is set.

I checked it with a patch in the emulator and noticed that value of register really changed and that divider should now be increased.

So I applied the patch in Ghidra and loaded the FW on the printer!

Hello slow SPI!

Getting the screen protocol!

After recording a complete protocol the printer is using I wasn't able to understand how it worked, and it was bit different than on mono 4K

So I got in touch with Igor, and he helped me to get the screen running in no time!

Trying to understand it

not every pixel value is transmitted
- there is some sort of compression in place
usually large blocks of the same color
RLE?

Trying to understand it

RLE - Run Length encoding
- send a value and then send a number of repeats
how are those values organized?
- 4 bits for the color + 12 bits for the number of repeats