Hacker Unlocks Deactivated Cricut Maker E-Waste Using RP2040 USB Proxy

Discovery and Initial Assessment

A Cricut Maker was salvaged from e-waste, noted to be in good cosmetic condition despite perished rollers. The device was expected to be locked due to Cricut's deactivation policies, which was confirmed upon testing. The previous owner likely received a warranty replacement or discount on a new model, leading to the deactivation of this unit.

Troubleshooting Deactivation

New rollers were sourced cheaply. The machine powered on and passed self-tests, communicating with its software, but displayed a "Machine deactivated" message. Initial attempts to rewrite the serial number via an EEPROM on the motherboard were unsuccessful due to the lack of an accessible EEPROM and a debugger for the MCU. Intercepting network communication was also considered but deemed too complex due to application security measures like certificate pinning.

USB Communication Interception

The focus shifted to intercepting USB communication between the Cricut and a computer. Wireshark was used to capture USB messages, revealing that the device uses USB CDC and transmits its serial number without checksumming or encryption. An RP2040 microcontroller, capable of acting as both a USB Host and USB Client, was used to create a proxy device.

Implementing the USB Proxy

Using TinyUSB Arduino examples for USB Host and CDC simple echo, a proxy device was assembled to rewrite the serial number. The RP2040 required overclocking to 240MHz for correct USB Host functionality. This setup successfully bypassed the deactivation lock, restoring full functionality to the Cricut Maker.