LaserCutter/Network Protocol

Our laser cutter communicates with its LaserCAD software over Ethernet. Let's find out how it works.

Technique

• Wireshark on the LaserPC
• Run different actions in LaserCAD
• See what happens on the network
• Replicate w/o LaserCAD

General Findings

• Communication over UDP Port 2027
• Sending HEX commands via Commandline:

 echo $COMMAND | xxd -r -p >/dev/udp/$LASER_IP/2027
 e.g.
 echo 7d7d7d7ca529 | xxd -r -p > /dev/udp/192.168.1.50/2027  #Stop current motion

Commands

Commands are noted in hex notation, translate to binary before sending.

Movement

LaserCAD has Buttons to control the movement of the laser head similar to the physical controller. Each button sends two commands, one specific one to start a certain motion, one generic one to stop it.

7d7d7d7ca53b #left
7d7d7d7ca53a #right
7d7d7d7ca534 #down
7d7d7d7ca535 #up
7d7d7d7ca529 #stop

Control bottons

7d7d7d7ca523 #reset
7d7d7d7ca53c #clip box
7d7d7d7ca53d #box
7d7d7d7ca528 #origin
 
7d7d7d7ca538 #stop
7d7d7d7ca539 #pause/continue
7d7d7d7ca53e #start

7d7d7d7ca520 # laser

Set absolute position

7d7d7d7ca50f7d7d7d7d7d7d7d7d7d7d #send to 0,0
7d7d7d7ca50f7d7d7e7b2d7d7d7e7b2d #send to 50,50
7d7d7d7ca50f7d7d7e73457d7d7e7b2d #send to 51,50
7d7d7d7ca50f7d7d7e6b5d7d7d7e7b2d #send to 52,50
7d7d7d7ca50f7d7d7b705d7d7d7b705d #send to 100,100

Get absolute position

Send command to laser:

7d7d7d7caa7d795caa7d794caa7d793caa7d792c # read current position

Receive on the same port (also via UDP):

7d7d7d7faa7c795c7d7d7d7d7daa7c794c7d7d7d7d7daa7c793c7d7d7d7d7daa7c792c7d7d7d7d7d	#pos at 0,0
7d7d7d7faa7c795c7d7d7d7a0faa7c794c7d7d7d7a0faa7c793c7d7d7d7d7daa7c792c7d7d7d7d7d	#pos at 1,1
7d7d7d7faa7c795c7d7d7b7067aa7c794c7d7d7d7d7daa7c793c7d7d7d7d7daa7c792c7d7d7d7d7d	#pos at 100,0
7d7d7d7faa7c795c7d7d7d7d7daa7c794c7d7d7b706aaa7c793c7d7d7d7d7daa7c792c7d7d7d7d7d	#pos at 0,100
7d7d7d7faa7c795c7d7d7b7067aa7c794c7d7d7b706aaa7c793c7d7d7d7d7daa7c792c7d7d7d7d7d	#pos at 100,100
7d7d7d7faa7c795c7d7d407934aa7c794c7d7d7d7d7daa7c793c7d7d7d7d7daa7c792c7d7d7d7d7d	#pos AT 1000,0
7d7d7d7faa7c795c7d7d7d7d24aa7c794c7d7d7d7d24aa7c793c7d7d7d7d7daa7c792c7d7d7d7d7d	#pos at 0.1, 0.1 (0.09,0.09 acc to lasercad)
7d7d7d7faa7c795c7d7d7d7c37aa7c794c7d7d7d7c37aa7c793c7d7d7d7d7daa7c792c7d7d7d7d7d	#pos at 0.2, 0.2

Example python code to do this:

import socket
import sys
from binascii import b2a_hex, a2b_hex

host = '192.168.1.50';
port = 2027;

# create dgram udp socket
try:
	s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except socket.error:
	print 'Failed to create socket'
	sys.exit()

msg=a2b_hex("7d7d7d7caa7d795caa7d794caa7d793caa7d792c")


try :
	s.sendto(msg, (host, port))

	# receive data from client (data, addr)
	d = s.recvfrom(1024)
	reply = d[0]
	addr = d[1]

	print 'Server reply : ' + b2a_hex(reply)
except socket.error, msg:
	print 'Error Code : ' + str(msg[0]) + ' Message ' + msg[1]