Laser/Hacking: Unterschied zwischen den Versionen

aus Metalab Wiki, dem offenen Zentrum für meta-disziplinäre Magier und technisch-kreative Enthusiasten.
Zur Navigation springenZur Suche springen
 
(7 dazwischenliegende Versionen von 2 Benutzern werden nicht angezeigt)
Zeile 1: Zeile 1:
−
For now just a unorganized pastebin to document things that don't fit the mastodon account.
+
For now just a unorganized pastebin to document things that don't fit the [https://chaos.social/@lazzzzzor mastodon account].
  
−
=== Device resolutions ===
+
=== Device ===
 +
We have a BRM 90130 driven by a Ruida Controller (RDC6332G)
 +
 
 +
=== Links ===
 +
==== Manuals ====
 +
[https://wiki.attraktor.org/images/5/59/BRM_90130_Gebrauchsanleitung.pdf BRM90130 Manual]
 +
 
 +
[https://torden.ru/wp-content/uploads/2019/03/Rukovodstvo-polzovatelja-RDC6332G-angl..pdf RDC6332G Controller Manual]
 +
 
 +
==== Reverse Engineering Resources ====
 +
https://edutechwiki.unige.ch/en/Ruida
 +
 
 +
https://wiki.fablab-nuernberg.de/w/Diskussion:Nova_35
 +
 
 +
https://stefan.schuermans.info/rdcam/messages.html
 +
 
 +
==== Tools ====
 +
RD-File interpreter and renderer: https://github.com/kallaballa/rdint
 +
 
 +
BRM branch of Ctrl-Cut: https://github.com/kallaballa/ctrl-cut/tree/brm
 +
 
 +
=== Dimensions ===
 
{| class="wikitable"
 
{| class="wikitable"
 
|-
 
|-
Zeile 32: Zeile 53:
  
 
We didn't get the net- to work (haha) so we are using USB right now.  
 
We didn't get the net- to work (haha) so we are using USB right now.  
 +
 +
Someone else already documented the protocol.
 +
Apparently everything is scrambled in some way byte-wise.
 +
https://stefan.schuermans.info/rdcam/messages.html
 +
 +
The descrambling process documented there didn't work for us.
 +
Since different versions of the program seem to use different magic numbers we decided to try to brute-force it.
 +
Turns out it's a new one: <code>0x33</code>.
 +
 +
==== Setup Messages [Still Scrambled] ====
  
 
Notation:  
 
Notation:  
Zeile 39: Zeile 70:
 
</pre>
 
</pre>
  
−
==== Setup Messages ====
 
 
Before sending the job to the lasercutter the driver sends and receives a few preflight messages.  
 
Before sending the job to the lasercutter the driver sends and receives a few preflight messages.  
 
We are unsure if they change when using the Network but they are omitted when saving a job to a file.  
 
We are unsure if they change when using the Network but they are omitted when saving a job to a file.  
Zeile 69: Zeile 99:
 
</pre>
 
</pre>
  
−
===== Click 'Search' =====
+
===== Click 'Search' [Still Scrambled] =====
  
 
<pre>
 
<pre>
Zeile 212: Zeile 242:
  
 
After this the actual job data is sent by the driver.
 
After this the actual job data is sent by the driver.
−
 
−
==== Job Data ====
 
−
The job data seems to be structured as follows:
 
−
 
−
1. [Unknown Data]
 
−
* (as of now always 59 bytes)
 
−
2. [Speed Data]
 
−
* (as of now always 8 bytes)
 
−
3. [Power Data x4]
 
−
* (as of now always 5 bytes for each of [Min Power Laser 1, Min Power Laser 2, Max Power Laser 1, Max Power Laser 2] )
 
−
4. [Unknown Data]
 
−
 
−
5. [Speed Data again, but a little different]
 
−
 
−
6. [Unknown Data]
 
−
 
−
7. [Power Data again, but a little different x4]
 
−
 
−
8. [Unknown Data]
 
−
 
−
===== 1. Unknown Data =====
 
−
59 bytes of ???
 
−
 
−
===== 2. Speed Data =====
 
−
 
−
<pre>
 
−
# Prefix (i think, not a 100% on that)
 
−
0xfb
 
−
0x38 (8)
 
−
0x34 (4)
 
−
0x34 (4)
 
−
0x34 (4)
 
−
 
−
# Value Bytes x3
 
−
0x36 (6)
 
−
0xc0
 
−
0x14
 
−
</pre>
 
−
 
−
'''50 mm/s:'''
 
−
 
−
<pre>
 
−
0xb2 (178) ()
 
−
0x36 (54) (6)
 
−
0x64 (100) (d)
 
−
</pre>
 
−
 
−
'''100 mm/s:'''
 
−
 
−
<pre>
 
−
0x36 (54) (6)
 
−
0xc0 (192) ()
 
−
0x14 (20) (�)
 
−
</pre>
 
−
 
−
 
−
'''1000 mm/s:'''
 
−
 
−
<pre>
 
−
0x90 (144) ()
 
−
0x38 (56) (8)
 
−
0x74 (116) (t)
 
−
</pre>
 
−
 
−
 
−
===== 3. Power Data [x4] =====
 
−
 
−
<pre>
 
−
# Prefix
 
−
0x75 (u) <- Always the same (message type identifier?)
 
−
0x84    <- Laser and Min/Max Byte
 
−
0x34 (4) <- Always the same (delimiter?)
 
−
 
−
# Value Bytes x2
 
−
0x16
 
−
0x02
 
−
</pre>
 
−
 
−
The Laser and Min/Max Byte is one of:
 
−
* <code>0x84</code> (Laser 1 MinPower)
 
−
* <code>0xf4</code> (Laser 2 MinPower)
 
−
* <code>0x02</code> (Laser 1 MaxPower)
 
−
* <code>0x72</code> (Laser 2 MaxPower)
 
−
 
−
''' 0% '''
 
−
<pre>
 
−
0x34 (52) (4)
 
−
0x24 (36) ($)
 
−
</pre>
 
−
 
−
''' 0.5% '''
 
−
<pre>
 
−
0x34 (52) (4)
 
−
0xe4 (228) ()
 
−
</pre>
 
−
 
−
''' 1% '''
 
−
<pre>
 
−
0xb4 (180) ()
 
−
0x92 (146) ()
 
−
</pre>
 
−
 
−
''' 5% '''
 
−
<pre>
 
−
0x36 (54) (6)
 
−
0x82 (130) ()
 
−
</pre>
 
−
 
−
''' 50% '''
 
−
<pre>
 
−
0x8e (142) ()
 
−
0xce (206) ()
 
−
</pre>
 
−
 
−
''' 100% '''
 
−
<pre>
 
−
0xce (206) ()
 
−
0xce (206) ()
 
−
</pre>
 
−
 
−
===== 4. Unknown Data =====
 
−
???
 
−
 
−
===== 5. Speed Data Again =====
 
−
<pre>
 
−
# Prefix is shorter this time
 
−
< 0xfb
 
−
< 0x32 (2)
 
−
< 0x34 (4)
 
−
< 0x34 (4)
 
−
 
−
# Value bytes are the same as above
 
−
< 0x36 (6)
 
−
< 0xc0
 
−
< 0x14
 
−
</pre>
 
−
 
−
===== 6. Unknown Data =====
 
−
???
 
−
 
−
===== 7. Power Data Again [x4] =====
 
−
 
−
<pre>
 
−
# Prefix
 
−
0x75 (u) <- Always the same (message type identifier?)
 
−
0xb4    <- Laser and Min/Max Byte
 
−
[No 0x34 byte this time.]
 
−
 
−
# Value Bytes are the same
 
−
0x16
 
−
0x02
 
−
</pre>
 
−
 
−
The Laser and Min/Max Byte is one of (last 4 bits are the same as in the first set of messages):
 
−
* <code>0xb4</code> (Laser 1 MinPower) (<code>0x84 + 0x30</code>)
 
−
* <code>0x94</code> (Laser 2 MinPower) (<code>0xf4 - 0x60</code>)
 
−
* <code>0x32</code> (Laser 1 MaxPower) (<code>0x02 + 0x30</code>)
 
−
* <code>0x12</code> (Laser 2 MaxPower) (<code>0x72 - 0x60</code>)
 
−
 
−
Comparison with first Laser Min/Max bytes in binary:
 
−
<pre>
 
−
12345678   
 
−
 
−
10000100 0x84 First Laser 1 Min
 
−
11110100 0xf4 First Laser 2 Min
 
−
00000010 0x02 First Laser 1 Max
 
−
01110010 0x72 First Laser 2 Max
 
−
 
−
 
−
10110100 0xb4 Secnd Laser 1 Min
 
−
10010100 0x94 Secnd Laser 2 Min
 
−
00110010 0x32 Secnd Laser 1 Max
 
−
00010010 0x12 Secnd Laser 2 Max
 
−
 
−
bit 6 == is min?
 
−
bit 7 == is max?
 
−
 
−
</pre>
 
  
 
=== Laserfirmware ===
 
=== Laserfirmware ===
 
Nope.
 
Nope.

Aktuelle Version vom 26. Mai 2021, 21:54 Uhr

For now just a unorganized pastebin to document things that don't fit the mastodon account.

Device

We have a BRM 90130 driven by a Ruida Controller (RDC6332G)

Links

Manuals

BRM90130 Manual

RDC6332G Controller Manual

Reverse Engineering Resources

https://edutechwiki.unige.ch/en/Ruida

https://wiki.fablab-nuernberg.de/w/Diskussion:Nova_35

https://stefan.schuermans.info/rdcam/messages.html

Tools

RD-File interpreter and renderer: https://github.com/kallaballa/rdint

BRM branch of Ctrl-Cut: https://github.com/kallaballa/ctrl-cut/tree/brm

Dimensions

Resolution Width Height
Physical   1300 mm   900 mm
Cut 13000 positions  9000 positions
Engrave 51181 points 35433 points

Instructions

Cutting

tbd

Engraving

tbd

Rotary Engraving

Get the rotate engrave tool and put it in the lasercutter (in a way where the wide side faces you). Align it to the X axis of the lasercutter. Connect the two cables to the two plugs on the upper right side of the inner workarea (labeled 'rotation'). Flick the Axis Y/Axis U switch on the side of the lasercutter to the 'Axis U' position. Turn the lasercutter on. Test if everything is working by moving the y axis. If the rotate engrave tool moves you're good to go. Move the laser over the object you want to engrave. Be sure that you are exactly in the middle of the object on the y axis. If the laser hits the object, press reset, the laser will move the z axis down. Repeat as many times as needed. In the driver software, enable rotate engrave in the 'Output' Tab. Set circle pulse to 7600 and enter the diameter of the object. Enter the speed an press 'Test'. Ensure that the object does not fall after rotating 360°. Proceed as you would normally when engraving.

Reverse Engineering

Driver (LaserWorks aka RDCAM)

Nope.

Communication Protocol

The protocol can be used in 3 ways.

  • USB
  • Network
  • By saving the job to a file in the driver.

We didn't get the net- to work (haha) so we are using USB right now.

Someone else already documented the protocol. Apparently everything is scrambled in some way byte-wise. https://stefan.schuermans.info/rdcam/messages.html

The descrambling process documented there didn't work for us. Since different versions of the program seem to use different magic numbers we decided to try to brute-force it. Turns out it's a new one: 0x33.

Setup Messages [Still Scrambled]

Notation: 

< == from the driver
> == from the laser

Before sending the job to the lasercutter the driver sends and receives a few preflight messages. We are unsure if they change when using the Network but they are omitted when saving a job to a file.

Some consistencies can be found when examining these messages. The laser always mirrors messages coming from the driver but changes one of the bytes and appends more data.

For example: 

# Message by driver
< 0x69 (i)
< 0x34 (4)
< 0xb8
< 0x4e (N)

# Response by Laser
> 	0x69 (i) <-- mirrored
> 	0xb4     <-- always changed from 0x34 to 0xb4 (+128)
> 	0xb8     <-- mirrored
> 	0x4e (N) <-- mirrored

# More Data
> 	0x36 (6)
> 	0x2c (,)
> 	0xb4
> 	0x76 (v)
> 	0x34 (4)
Click 'Search' [Still Scrambled]
< 0x69 (i)
< 0x34 (4)
< 0xb8
< 0x4e (N)
> 	0x69 (i)
> 	0xb4
> 	0xb8
> 	0x4e (N)
> 	0x36 (6)
> 	0x2c (,)
> 	0xb4
> 	0x76 (v)
> 	0x34 (4)

< 0x69 (i)
< 0x34 (4)
< 0x34 (4)
< 0x84
> 	0x69 (i)
> 	0xb4
> 	0x34 (4)
> 	0x84
> 	0x34 (4)
> 	0xb2
> 	0xd4
> 	0x0a
> 	0x14
Select COM Device
< 0x69 (i)
< 0x34 (4)
< 0x34 (4)
< 0x24 ($)
> 	0x69 (i)
> 	0xb4
> 	0x34 (4)
> 	0x24 ($)
> 	0x34 (4)
> 	0x34 (4)
> 	0xb4
> 	0x74 (t)
> 	0x34 (4)
Sending a Job
# Same as first message in 'Click Search' (x2)
< 0x69 (i)
< 0x34 (4)
< 0xb8
< 0x4e (N)
> 	0x69 (i)
> 	0xb4
> 	0xb8
> 	0x4e (N)
> 	0x36 (6)
> 	0x2c (,)
> 	0xb4
> 	0x76 (v)
> 	0x34 (4)

< 0x69 (i)
< 0x34 (4)
< 0xb8
< 0x4e (N)
> 	0x69 (i)
> 	0xb4
> 	0xb8
> 	0x4e (N)
> 	0x36 (6)
> 	0x2c (,)
> 	0xb4
> 	0x76 (v)
> 	0x34 (4)

< 0x69 (i)
< 0x34 (4)
< 0xba
< 0x22 (")
> 	0x69 (i)
> 	0xb4
> 	0xba
> 	0x22 (")
> 	0xbe
> 	0xa4
> 	0x58 (X)
> 	0x34 (4)
> 	0x34 (4)

# Again, same as first message in 'Click Search'
< 0x69 (i)
< 0x34 (4)
< 0xb8
< 0x4e (N)
> 	0x69 (i)
> 	0xb4
> 	0xb8
> 	0x4e (N)
> 	0x36 (6)
> 	0x2c (,)
> 	0xb4
> 	0x76 (v)
> 	0x34 (4)

# ???
< 0x69 (i)
< 0x34 (4)
< 0x38 (8)
< 0x34 (4)
> 	0x69 (i)
> 	0xb4
> 	0x38 (8)
> 	0x34 (4)
> 	0x34 (4)
> 	0xb2
> 	0x4e (N)
> 	0x34 (4) <- This byte changes to 0x40 sometimes... (no idea why, seems to happen when one moves one point of the line in the test job for example.)
> 	0x34 (4)

# Again, same as first message in 'Click Search'
< 0x69 (i)
< 0x34 (4)
< 0xb8
< 0x4e (N)
> 	0x69 (i)
> 	0xb4
> 	0xb8
> 	0x4e (N)
> 	0x36 (6)
> 	0x2c (,)
> 	0xb4
> 	0x76 (v)
> 	0x34 (4)

After this the actual job data is sent by the driver.

Laserfirmware

Nope.

Abgerufen von „https://metalab.at/wiki/index.php?title=Laser/Hacking&oldid=70852“