While taking immoderate rubbish down I spotted a Cricut Maker successful e-waste. A speedy look astatine it revealed that the it was successful reasonably bully cosmetic information pinch the objection of the rollers being perished. I guessed that the rollers were the logic why the portion was trashed and decided to return it backmost location to investigate. I knew that Cricut were beautiful fierce pinch disabling/locking machines, but I gathered it would still beryllium worthy playing astir for immoderate fun. As it turns retired this instrumentality was locked, which was beautiful expected. However pinch immoderate hacking I was capable to return it to having afloat functionality. It’s very apt that the past personification either received a warranty replacement aliases a discount connected a newer model.
Alex did immoderate speedy searching and recovered that replacement rollers were readily disposable for very fewer dollarbucks. Even pinch powering the instrumentality disconnected 12v alternatively of the apparently required 18v, it showed signs of life pinch it passing it’s aforesaid trial and communicating pinch the package - though showing the dreaded “Machine deactivated” connection erstwhile connecting to it.
The first attack I thought I’d analyse is if location was an eeprom connected the motherboard that I could rewrite the serial number. Disassembly isn’t for the fainthearted - it’s involved but I would request to do this to switch the rollers regardless. I didn’t find immoderate eeprom and the MCU being utilized is thing I didn’t person a debugger for.
My 2nd thought present was to intercept the web relationship and either switch the serial number aliases return a occurrence connection instead. However various exertion information measures made it much annoying than I wanted to disable certificate pinning. That’s not to opportunity you can’t - it’s conscionable I didn’t fig retired really to do this trivially.
My attraction changed to performing a intercept connected the connection betwixt the cutter and machine itself. I fired up wireshark to seizure USB messages betwixt the Cricut and my machine. It uses USB CDC for connection and very quickly I recovered the packets responsible for sending the serial number. There didn’t look to beryllium immoderate checksumming aliases crypto. So I borrowed a RPi RP2040 from Droppy which was capable to enactment arsenic some USB Host and USB Client.
Using the TinyUSB Arduino examples for USB Host and CDC elemental echo, I was capable to cobble together a elemental proxy/rewriting device. There was thing to typical astir this, nevertheless it did return maine a small while to fig retired that the USB Host doesn’t activity correctly unless overclocked to 240MHz. I besides configured each the USB metadata for illustration vendor/product id and descriptions to lucifer the unit. When it detects a packet from the cutter that matches the correct length, and has the bid / serial number successful it, it replaces it retired pinch a different serial number. Serial numbers look to beryllium issued sequentially and you tin spot the position of each the units connected Cricuts ain webpage.
With the rewriting instrumentality replacing retired the serial number astatine a hardware level the package is nary the wiser. The portion shows up successful my account. I could moreover registry serial numbers that didn’t beryllium connected the Cricut instrumentality position page.
Obviously this raises the mobility astir random strangers being capable to get different users Cricut serial numbers locked retired aliases added to their accounts….
After cleaning up the unit, replacing the rollers (hint, usage basking h2o to soften the caller rollers to instal them), reassembling the Cricut and printing a small lawsuit for the RP2040 - I was capable to usage the portion arsenic if it were marque new.
The attack I took to return this Cricut to functioning is astir apt the slightest personification friends measurement however, arsenic I judge package only solutions exist. Some alternatives that travel to mind are:
- Intercept web postulation aliases spot the exertion to study a different serial
- Write a driver that pretends to beryllium a Cricut USB CDC relationship and proxies the serial
- Write a driver that pretends to beryllium a Cricut USB CDC relationship but connects to the Cricut via Bluetooth
- Figure retired the firmware update process and utilise that to spot the serial number arsenic portion of the update
- A instrumentality that acts arsenic a bluetooth proxy
- Add different MCU betwixt the bluetooth spot and the Cricut MCU to rewrite the serial number earlier it goes to the bluetooth chip
I’m not going to analyse immoderate of these because I person thing that useful for me, but those are each viable options to explore. Additionally I’m not going to stock the codification required to execute the serial number alteration arsenic this mightiness not beryllium exempt successful Australian Copyright rule (not a lawyer ect….), but it’s beautiful adjacent to the included examples successful the TInyUSB Arduino library
English (US) · 
Indonesian (ID) · 
