Cricut Personal Dissection

Here's what I found in my dissection of my Cricut Personal cutter.  I think this is a pretty good jumping off point if you're interested in repurposing the hardware, but for now I'm not doing any advanced analysis of the circuits (tracing pinouts, etc).  This may come later if I decide to make some custom firmware to do some other fancy things.

Actuators:

2 Steppers - 42BYGH4418 - These are standard NEMA 17 sized steppers with 6 leads.  I  didn't find any specific data on this stepper most likely driven in a unipolar configuration.

1 Solenoid - The cutter head seems to be a custom solenoid setup.

Chips:

ATmega128 - Main microcontroller for the entire system.

FT232BM - FTDI USB to RS232 converter chip.

AT45DB041D - 4MBit Serial EEPROM - This seems to be where the built in "Goerge and Basic Shapes" cartridge data is stored.

Power:

LM317 - 1.5A adjustable voltage regulator - Outputs 2.4V at power on.

LM2576 - 5Volt 3A Step Down Switching Regulator

18V 2.5A Power Brick - Labeling seems to suggest there are 16V, 20V, and 21V versions as well.

Other Parts:

BD243C NPN Transistors and high wattage resistors - These 8 transistors are driving the individual stepper coils.  The power resistors, transistors, and diodes in the center of the motherboard above all form the stepper control for the two steppers used in the setup.  The steppers are driven off of the 18V supply from the power brick.

Potentiometers - The speed, pressure, and size dials are all just connected directly to potentiometers.

"George and Basic Shapes" cartridge tear down:

Here's a picture of the "George and Basic Shapes" cartridge from the side facing tward you when inserted into the machine.  This is the cartridge that comes with the machine and is just a couple pins shorted together.  If you've searched for Cricut hacks before, you probably already knew this, as this seems to be one of the few details floating around.  I did manage to disassemble a standard cartridge at an earlier date and it contained an Atmega chip and another mysterious 8-pin Atmel chip just like the motherboard.  I'll have to borrow another cartridge or two in the future and post some pics.

The back seems to be a mirror of the front.  It seems that rather than key the cartridges, they simply manufacture them so they can be inserted either way and function normally.

Cartridge socket machine side:

You can see from the traces on the cartridge socket PCB that the connections are mirrored on the machine side as well.  After taking a look at the cartridge board, I simply disconnected it and used jumper wire to short the appropriate pins to emulate a George cartridge on my unit as many others have done since the George cartridge above is one that I borrowed.  Here's a pic of my George cartridge emulation setup:

George Cartridge Emulation

This solution works nice for me since it's quick and easy and I don't plan on using the Cricut with the standard cartridges.  You can just as easily emulate a George cartridge a number of other ways if you what to still use other cartridges with the machine normally, ranging from making your own PCB to just gluing some foil traces to a piece of cardboard that will fit in the slot.

More hardware details to come as I start looking at signals and set up serial sniffing...

Tags:

38 Responses to “Cricut Personal Dissection”

  1. Andrew says:

    Have you had any luck figuring out the code that tells it what to print?

  2. Craig says:

    I’ve figured out how to do basic logging right now, but I haven’t gotten a true pass through setup up and running. As soon as I get that working I’ll post some more info.

  3. Andrew says:

    What are you using for logging? I haven’t had much luck with it, the serial sniffers don’t see any data for some reason.

  4. Craig says:

    I tried serial sniffers too. Turns out that the Cricut FTDI USB to RS232 link operates at about 200kbps baud. You can’t use the standard virtual COM port driver to talk at that speed, you have to use FTDI’s D2xx drivers. I used a couple of TTL-232R cables and a Python script that uses pyUSB to set up some basic sniffing, but without a pass through connection working, you can’t get as accurate a picture of what’s going on.

    Looking at the serial communication from the PC, there seems to be a few timing issues that need to be sorted out. For instance, it looks like only one byte is sent at a time to the Cricut and it seems to be sent at 1ms intervals most of the time. The link back to the PC seems to be a little less restrictive, with several bytes being returned at a time.

    If you want to take a look at it, I can send you some Python code to get a similar FTDI based serial to USB adapter configured to sniff the serial data. I wanted to post up a ton of details on this, but I’m holding off until I’ve got a couple more issues figured out and I can just post a logging script that anyone can use to start looking at the command protocol.

  5. Ron says:

    I have a sneaking suspicion that the ATMega16 on the regular carts is responsible for matrix math, resizing or something like that.

  6. Andrew says:

    Craig,

    If you’re up to it, send me the code and I’ll work on it as well.

    Thanks,
    Andrew

  7. Ned says:

    I’ve just opened up a Cricut Expressions machine for reverse engineering. Looks like the board is more or less the same as the smaller unit (despite having “Cricut Expressions” silkscreened on it). It also has the same 4Mbit SPI flash part (Atmel AT45DB041D) on it; mine is also named George. I’m using Macs here, which have the distinct advantage of having Dtrace available. So writes to (and reads from) the FTDI should be easily logged (with good timestamps). Also, I have a 16-channel mixed-signal oscilloscope which might help. My guess is that the over-the-wire communications is in terms of cubic Bezier splines (which are also the basis for TrueType fonts). These are easily scaled and rotated (once you accept the need for floating-point and matrix math). I’ve done a port of the Cairo library and also worked with a TrueType font driver, so I’m not unfamiliar with this stuff. And I also have hacked a lot of AVR code and done reverse engineering for a living.

  8. Craig says:

    Thanks for the info! I wish I had access to a good MSO or a least a scope with a bigger sample buffer; it might make figuring out the timing issues easier :). I’m currently busy moving my workshop to a new location, but I’ll try and get some more info gathered and posted after I get settled in to my new location, which should be some time in the next two weeks.

  9. Sherry says:

    I bought a cricut expression at Goodwill for a song – but one end of the machine was off – piece is there to replace – and there is a gray cable that goes into the machine – but I can not figure out how to get into that area of the machine. I have taken the bottom off and pretty much of the side…. any ides on what the gray cable goes to and if I can get into the machine to connect – would love to see this machine work.

  10. batwench89 says:

    I have taken apart my expression, and found the capacitor on L1 between C30 and C32 looks fried. It has shrink tubing on it so I can not see the markings on it. Also I have found the flow of the solder did not make it all the way up most of the leads. There are 2 holes that look like they are filled but I think they are not supposed to be. I am not sure if that will make a difference in the grand scheme of things but when I was building circuit boards for fork trucks they really needed all the solder up the leads, the holes with no parts were empty and the flux cleaned off the board. I have some pictures of both sides of the main board if anyone is interested. batwench89@yahoo.com

  11. Craig says:

    Thanks for the offer, but I already picked up an Expression and verified that the control software works with that model. Sounds like you blew an inductor on your board, I’ll look at mine and see if I can identify the correct replacement for you.

  12. Arlet says:

    I got an old cricut to play with, and rather than trying to figure out how to work with the existing firmware, I decided to erase the CPU and substitute my own firmware. I’ve got most of the main board figured out, as well as the connections to the LCD module, the keypad, and the stepper motors. I’m to the point where I can write arbitrary text to the LCD, and draw some straight lines on the paper, adjust the pen pressure, and read the keypad.

    I’m planning to release the firmware sources soon. If anybody is interested in this project, let me know.

    Programming the AVR is actually quite easy, because all the necessary serial programming signals are available on the cartridge connector (the main board even says “IO Cartridge & STK500” under the 10-pin connector).

    Note that this project requires completely erasing the existing Cricut firmware, and there’s no known way to restore it.

  13. Arlet says:

    I just added some code to read the AT45DB041D part on my old cricut personal, and at first sight does not seem to be encrypted.

    It starts out with the word “PROGRAMMED”, and I can see the names of all the letters and symbols, interspersed with somewhat regular looking data.

  14. Craig says:

    Awesome! I’d really like to hack up a personal and modify it for direct PCB routing some time. I’ll try and add the pin-out for this to the wiki as well.

  15. Arlet says:

    I was curious so I spent last Sunday looking at the AT45DB041 data. It starts out with a big (offset?) table, followed by a list of records, consisting of 2 byte length, 2 byte ID, and contents. The bulk of the cartridge is made up out of “GL” records containing the glyph data in a format that looks very much like the truetype “glyf” table, but with extra off-curve points for cubic beziers.

  16. Skatun says:

    Hi
    Alert>Did you write the code with arduino enviroment?
    Keep me posted how the hacking goes, i would like to use the cricut as a platform for a small cnc mill with a dremel tool. I would then try to add a z-axis aswell

    Does it use G-code?
    Kim

  17. Meghan says:

    Arlet – are you still working on this project? Have you found anything new about the 10 pin cart?

  18. Hypnotoad says:

    We have a machine we use to make cards for the handicapped but the knob you turn for the size setting doesn’t register I suspect its come loose on it shaft or something.

    Can anyone tell me how to get the side of the machines off, I have the bottom off but am not sure how to remove the side so I can get to the shaft and switch assembly.

    Any help would be appreciated.

  19. Arlet says:

    @Skatun: no, I used plain C to write the code. You can download it here: https://github.com/Arlet/Freecut

    I’m pretty much finished with this, but the code is available if anybody wants to continue hacking on it. It doesn’t support G code, but it can be easily modified to do so.

    @Meghan: I sniffed the communication between the card and the machine, but it’s encrypted. The data on the serial flash chip itself is not encrypted, though, so if you don’t mind opening up the cartridge, and directly access the serial flash chip on it, you can read out the contents, and decode the glyph table with all the shapes. The easiest way to read the contents is to solder some wires on the AT45DB041 I/O pins, lift up the reset pin, and keep the Atmel in reset state. Here’s a demo with a “George” shape that’s coming straight out of the internal flash: http://www.youtube.com/watch?v=mu8DaRkrdCc (this decoder is not included in my firmware release though, to avoid problems with provo craft)

    @Hypnotoad: The sides can be removed by sliding an old credit card between the side and the machine, and try to unhook all the little catches. You may have to pull on it a bit. With a bit of care, it can be done without any damage.

  20. Jayne says:

    I think the electronics in my cricut have died. It is only one month old. Because I brought it in America the Australian agent wont look at it and because I took in out of America they wont cover it on warranty either. All the lights beside the screen are lit up, when a letter is pressed a random letter appears in the screen, it beeps loudly when I press a letter and it wont cut. Can anyone help??? Is it possible to get parts. Where would I get these from?

  21. Craig says:

    Can you try to upgrade the firmware using a PC and the trial version of design studio (http://www.cricut.com/cds/)?

  22. Jayne says:

    Thanks Craig, I’ve got design studio so I tried updating the firmware and did another reset also but it is still not working. Any more ideas?

  23. Craig says:

    Humm… So it didn’t complete the firmware upgrade? What did Design Studio say? Does it seem to restart randomly (after messing with it does it move the rollers and beep occasionally)? Beyond trying to get the firmware upgraded, there’s not a whole lot you can do without opening it up and poking around.

  24. Jayne says:

    The firmware upgrade worked. It said it was completed. It turns back on but all the lights are still on and what comes up on the screen is not what I am pressing.
    I am trying to find someone who may be able to look inside and replace parts if that is possible. Thanks for your suggestions anyway.

  25. Bill says:

    Jayne,
    Not being electronic guru I can’t tell you exact reason for your problem but I suspect it some resistance problem with keyboard. I’ve been messing with lots of Cricuts with problems.
    Good news is even when i hook it up using make the cut, sure cuts alot, and designer studio, I just use the pc to enter and see. Not only that it’s easier to use than the little screen. As long as designer studio can update provos firmware you can still use your Cricut. Just not standalone.
    The same way when the size wheel doesn’t work. You don’t use the wheel at all when you’re using pc.
    There was a period where I got alot of Cricuts with wheel problem. They really liked their defects once they saved a lot of money by using a $5 USB cable and hook up a pc.
    The key is getting the Cricut firmware update. I’ve also got a few Cricuts that will not pass the first step where power and stop held the get the beep to start the update. I hope I can debug some of those dead boards using the code Arlet has.

  26. Bill says:

    From what I’ve seen hacking into most Cricit carts is very hard. From what I understand is part of the Atmels design is it’s built in encryption. Hard hard to get decrypted. I think that’s what Provo saw when they picked that design. What I don’t know is if the data on the cart is still encrypted as it passes through the 10 pin port and decrypted prior to cutting. The George and shapes data is already in the Cricut which is why it doesn’t need a cart. The firmware requires a cart to achieve a ready status. Provo just created a shunt for those three lines. On my own machine I used an old motherboard shunt with another pin connect with short wire where the ribbon cable connects the cart connect to Cricut motherboard. I never use cartridges myself.
    Bill

  27. Bill says:

    When “Make the Cut” first came out, it had a hook for design studio to capture the design created. MTC created a file that was captured instead of actually sending the data stream to a Cricut. Make the cut got sued and the abiliity to backup your Cricut carts was lost. So while it’s hard to decyrpt a cart, it has happened. At some point any encrypted data has to be decrypted to be used. That has always been the weak link in copy protection since.
    Bill

  28. Arlet says:

    @Bill:The cartridge contains an Atmel CPU and a serial flash chip. The designs are stored, unencrypted, on the serial flash chip. The CPU contains firmware to encrypt this data, and send it to the cutter through the 10 pin port.

    If you get the data straight from the flash chip (either by desoldering, or attaching some wires, and suspending the CPU), the designs can be read and decoded.

  29. dardie says:

    any way to figure out what get written back to the cartridge to disable/flag it from being updated on a gypsy?

  30. Craig says:

    There are a number of things that could be written to the EEPROM on the cartridge, or even the ATMEL chip inside it to mark it as used, but I don’t plan on investigating “unlocking” cartridges any time in the future though.

  31. Fram says:

    Any idea what controls the paper feed? Mine refuses to feed the paper into the machine…..I’m about to pull my hair out….

  32. Fram says:

    I did reset and it helped nothing….

  33. […] options: Freecut — Firmware replacement, haven’t tried. Cricut dissection, discusses the default blank cartridge. ATX Hackerspace cricut page Build-to-spec Cricut Hacks Wiki […]

  34. PAT GREENE says:

    I HAVE AN OLD CRICUT EXPRESSION MACHINE THAT I HAD STORRED FOR A WHILE AND APPARENTLY A MOUSE DECIDED TO MAKE IT HIS HOME. HE CHEWED A FEW WIRES AND GUESS WHAT, IT STOPPED WORKING. I GAVE IT TO A FRIEND TO TAKE A LOOK AT AND HE SPLICED A COUPLE OF WIRES AND IT DOES FUNCTION A LITTLE BIT, BUT DOES NOT READ THE CARTRIDGE. I TOOK IT APART A SECOND TIME AND NOTICED THAT THE CARTRIDGE CONNECTOR WAS NOT CONNECTED. I RECONNECTED IT, BUT NOTICED THAT THE RED WIRE HAD BEEN SEVERED IN MULTIPLE LOCATIONS NEXT TO THE END OF THE CONNECTOR. I KNOW BASICALLY NOTHING ABOUT ELECTRICAL DEVICES. CAN YOU TELL ME WHERE I MIGHT FIND THIS PART? THANKS, PAT

  35. xochitl martinez says:

    Help! I dropped myy Expression, out of warrenty, & the cutting chamber (grey box wi it th the cricut on the front) gets stuck all the way to the right side. It wont move, even pulling hard with two hands. And makes an awful roar with vibrations as it turns on. I’vve tried resetting but no luck. I’d appreciate any suggestions. Thank you.

  36. Craig says:

    Looks like you’ve got a mechanical problem, unfortunately. The best advice I can give you is to make sure the carriage (the gray box that moves and holds the cutter) has it’s rollers in place, as it can get off it’s linear rail (the metal rail at the back of the carriage that it rides on). With the power off you should be able to move the carriage easily left to right with little resistance. If you can’t do that there’s probably something broken mechanically that you’ll have to replace.

  37. Anjana says:

    it’s amazing how a few bucks and a bit of creeohnt effort create something so ridiculously beautiful!If I could have something like this in my house, I swear I’d keep it all year round because I’d be so, so proud of it.It’s elegant, quirky, unique, and I think it really has my name written all over it yet again. Get out of my head, lass. You’re causing a creative itch!Why, oh why do our pound shops not sell ravens and pumpkins? What the heck???

Leave a Reply