The Cricut Seems to Be Ripe For the Hacking

My Cricut

A member at the hackerspace donated a Cricut 6" cutter when she upgraded to the Expression model.  I've seen these little devices in most craft stores and even Wal-mart, and they seem ripe for the hacking.  The Cricut line of personal CNC paper cutters appear to have been looked into on a number of occasions from what I could find, but I didn't really find any good resources for information on hardware hacking other than a couple simple hacks and the discovery that the Cricut USB link was actually an USB to RS232 connection.  I also didn't find any open source or homebrew software to turn these devices from advanced scrapbook die cutters to general purpose CNC paper cutter/plotter/whatever.  I really want to play around with this thing (including trying to mount a spindle on it for crude PCB routing, among other things), but it looks like someone still needs to do a little leg work to make that happen easily.

What I did find is that there are  a few proprietary software packages out there (Sure Cuts A Lot and Make The Cut) that allow you to place and cut TrueType fonts and SVG format vector graphics.  This coupled with the fact that the device was using an RS232 link to do the actual communication to the on board microcontroller led me to believe it should be trivial to back-engineer the command protocol.  I downloaded the trial versions of the available 3rd party tools and grabbed a few windows serial port sniffing applications and set off to start logging communications.

Unfortunately I found that no combination of serial sniffer and control software seemed to work out.  I can easily use the serial sniffers to look at the transactions of the Arduino bootloader and the host application over the USB to RS232 link, but I see no activity with the 3rd party Cricut software.  I can set up a USB sniffer link and log data, but these logs are relatively verbose and I'd like to use a more elegant solution to log the RS232 data directly.

Since I'm more comfortable with the hardware side of things, I'm currently focusing on the problem from that angle.  I didn't want to start chopping up the space's Cricut, I set out to acquire my own for the task.  I managed to scoop one up for $60 with no cartridges from an individual who upgraded to the Expression as well.  Stay tuned for some hardware dissection notes as I take my personal unit apart!



21 Responses to “The Cricut Seems to Be Ripe For the Hacking”

  1. Emma says:

    So I have a cricut expression and it fell over, when it did, the size got stuck on 2 inches. I took the thing because I thought there would be a gear that maybe needed fixed, nope, it was a motherboard type looking component it says VZencoder, E252800 with a back stamp of ZD and something that looks like a backwards R and a U JD-F, any idea where I could get a replacement part?

    Thanks, p.s. your documentation ROCKS!

  2. Craig says:

    I haven’t taken apart an Expression yet, but I imagine it’s got a little more under the hood than the Personal. Nothing came up immediately in any searches for the component you’re describing, but from your description it sounds like the Expression might use rotary encoders (here’s an example of one that’s sold by SparkFun) instead of potentiometers to set the size, pressure, etc. One clear indicator that it’s using rotary encoders would be if the dials can be rotated more than one rotation. I don’t have access to an Expression right now but I’ll let you know if I get the opportunity to take one apart.

  3. Kansas says:

    I have a pretty simple tutorial on my blog for making the George & Basic Shapes Cartridge. Almost everyone hasn’t had any problem but a couple of people are saying after making it their cricut no longer recognizes any other cartridge. One woman first tried testing with the paperclip method so I don’t think I’d say it was the homemade george but the other one strictly used the homemade cart. Resets were tried, unplugging, etc… nothing works. I’ve searched online and found nothing regarding this problem or a way to fix it… I came across your blog and you seem to know the “insides” pretty good, any ideas why this happened or how to fix it?

  4. Kansas says:

    Almost forgot:
    PS I do have a disclaimer at my blog if one does make the george cart but am seriously thinking of pulling the whole post. It’s just that I see over 5000 views on the message board and only two (possibly 3) people have had this problem.

  5. Kevin says:

    Hey everyone,

    If it helps, I did the cartridge hack on my wife’s Expression, and I can note two things:

    1. The hack works, I get the george/basic shape cart.
    2. The board looks pretty similar to the standard Cricut. It is a little more difficult to open I think. The board is off to one side, and the wires leading into the unit are very short, so it’s hard to pivot the bottom down as much. However, it does appear to be the same board.

    Obviously the display is a little different, but it probably takes the same number of pins to drive, so the mainboard is likely the same.

    I’m guessing the carts are interchangable as well? I’m not sure on that point, but I would guess they only contain vector files, etc, and the actual allowed dimensions are controlled by the firmware in the unit.

    Hope this helps someone, and thanks for the hack. I bought our expressions off of Ebay for $180, with no cartridge, so this saved us a few bucks!


  6. Craig says:

    It’s possible that they have accidentally shorted a couple of the pins together when trying this, probably one that’s connected to the ground or power and one of the other pins. This can break your Cricut permanently if you blow one of the pins of the micro controller (chip makers call this Electrical Over Stress or EOS). You really need to be careful when sticking little metal bits into any sort of socket, the Cricut is no exception!

  7. Jen says:

    I have the same problem as Emma. My Cricut Expression was dropped and snapped the mother board that is used by the dial to make images larger. The mother board says ENCODER, V2Encoder, E252800, JD-F. Any chance someone has a broken cricut expression and I could buy this mother board.

  8. Doug says:

    Hi there,
    I too, have the problem with the rotary dial encoder.
    I’m still under warranty but fear that if this is a damaged unit due to fall, they might not honor the warranty. Specifically, I got it from Wallmart for $200. Should have been a clue but was away from home, no time to test it etc.
    Any suggestions about disassembly? Even that would be helpful.

  9. Craig says:

    Are you sure it’s the rotary encoder? What model to you have (Personal/Expression/Create)? If you’ve got a Personal, the potentiometer used should be easy to replace. I’ll strip down mine a bit more and see if get some pics of the pots/encodes and see if I can find some part numbers.

  10. Ethel says:

    Hi, I have the cricut create. Used it for a day and a half and then it just froze. When I tried to turn it on again, there was no power. Emailed PC about it but they refused to honor the warranty since I am in the Philippines. I had a friend look at it and was told that there was a problem with the PCB. I have no background in electronics so I don’t even know what that is. Can anyone help me find a new PCB? Any info will be appreciated.

  11. Hayley says:

    For the record, I just looked at the Make the Cut site. They no longer support the Cricut. Bummer.

  12. Andrew says:

    Hi, I just stared looking at all of this because a friend purchased one of these Cricut Expression machines and was asking if I could do anything because she know that I hack computer and electronics all the time. The hacked cartridge that Kansas describes how to make set off alarm bells for me instantly. That cartridge does nothing more than short a couple of pins in the cartridge slot. So this says to me that all of the shapes you can unlock already exist in the Cricut machines circuitry/memory. I would be very interested in what the other cartridges are like. Do they simply short other pins in different combinations to open existing patterns on the machine already? Talk about a money grab.

  13. Craig says:

    Other carts are considerably more complex than a couple shorts:

    They actually have their own memory and a microcontroller on board.

  14. nick says:

    Has anyone tried making a way to use an SD card to copy cricut cartridges?

  15. Tom says:

    I have a good one for you. My wife bought a Gypsy and that piece of garbage kept freezing during the update. Apparently, the Gypsy burns a serial number of the gypsy into the cartridge when you connect it and can’t be connected to any other Gypsy. Her original one broke and she sent it in, but they were supposed to encode it with her original serial number.

    I’m curious if there is a way to remove that serial number from the cartridge so it can be synced with another one.
    They are on my bad side because they sent her replacement unit but it didn’t have her original serial number, thus she can’t use her cartridges. I’m sure it’s written to the eeprom.

  16. Craig says:

    I’m aware of the Gypsy thing via some more avid Cricut owners I know. I’m avoiding looking into anything that would allow you to copy cartridges or use cartridges in any way not specifically intended by Provocraft. Anything that would potentially allow you to make copies of the cartridges or bypass the cartridge locking would likely be a violation of the DMCA and would be helping people commit copyright infringement.

    Provocraft doesn’t want people swapping and copying cartridges to multiple Gypsies, they want everyone using the designs on a cartridge to buy a copy of that cartridge. That’s understandable, as people could organize cartridge loading parties and just swap around carts, allowing many people that didn’t buy a cart to use its designs. This would be like one person buying a full copy of Windows 7 and having a Windows install party, installing Windows on multiple friend’s PCs.

    In the case of Cricut carts, you can still use the carts and loan them (disclaimer: I’m not actually sure if this is against the EULA but it seems like it shouldn’t be), you just can’t make another digital copy. It’s unfortunate that Provocraft doesn’t have some way to link copied cartridges to an individual user so you could register a new Gypsy and reload your carts, but it’s easy to see why they don’t because of potential abuses.

  17. Nikki says:

    I have an expression, bought it used but it appeared to be brand new. Boots up fine, but the wheel that loads the mat won’t spin. I can turn it with my hands, but it’s very difficult to move. Any ideas or advice on taking the thing apart and trying to fix it?

  18. Craig says:

    From my experience, it should automatically turn the mat loading mechanism at boot try to kick out a mat if one is loaded. If yours isn’t even doing that, it might be that you’ve got a bad stepper (the actual motor) or some of the drive circuitry has gone bad. Finding a replacement unipolar stepper motor shouldn’t be too hard, as they look like standard NEMA17 sized motors on my Cricut Personal. As for wiring the motor up or debugging the electronics, you’ll need a little bit of electronics know-how to find what coils are wired up where and how to check the various portions of the motor driver circuit.

    The driver looks like a pretty simple unipolar setup with through-hole components, so if you know a bit about electronics there’s a good chance you could repair it if nothing’s wrong with the microcontroller that’s driving it (like ESD damage). Check out my post on dissecting the Cricut Personal, the Expression motherboard is pretty similar:

  19. Dodi Callander says:

    For whoever has completely dissected an expression:

    I dropped my expresison, and at first it seemed that only the communication port was damaged. My hubby,being electronically inclined, got a new port and soldered it onto the board. Unfortunately, he broke the trace and now it does not communicate at all. To top it off, the size dial no longer works and none of the cricut resets fix this. He took the whole thing apart, made sure the little circuit board on the dial was pushed in all the way, but no luck.

    Anyone out there know another fix for the size dial and where the trace from the com port goes? If we could fix the com port the size dial would not be necessary because of the design studio software.



  20. Scott says:

    My power cord got tore from my wife’s personal cricut machine and broke the prong inside power connection hole. Anyone know where I can buy remplacement port? The power cable cord is fine.

  21. mod hacks says:

    Truly no matter if someone doesn’t understand then its up to other viewers that they will help, so here it happens.

Leave a Reply