Cricut Commands

From Cricut Hacking Wiki
Jump to: navigation, search

Table of Commands

Cricut Commands

Command Code First Generation Hardware Second Generation Hardware]]
Mat Bounds 11 Y Y
Firmware version 12 Y Y
Status Request 14 Y Y
Cartridge Name 18 Y N
Start Transaction 21 Y N
Stop Transaction 22 Y N
Unknown Command 81 Y N
Move Command 40 Y N
Size Only Command N Y

General Command Concepts

Cricut Commands send the number of characters to expect then follow it with either a command or encrypted data or sometimes both.

Send: 04 11 00 00 00

The above example sends the number 4 so that the Cricut knows how many bytes to expect. This first byte is not included in the expected byte count. These values are in Hexadecimal] so the maximum number of bytes that can be sent in this format is 256 or FF. The next byte '11' is the standard command for a Mat Bounds request. The additional 00 bytes are sent to meet the requirements of the byte count. Some commands could be shortened:

Send: 01 11

This technique should not be considered reliable, the standard is a four byte command. All bytes following the size are byte swapped for Big Endian vs. Little Endian at the value break. This can be very confusing so the examples are as follows. Data portion of a 0x40 Move Command: 23 48 00 00 4A 02 00 00 7B 01 00 00 (before Encryption)

The First four bytes are swapped from 00 00 48 23 and 00 00 02 4A and 00 00 01 7B. Reversing the byte Array doesn't work, the bytes of each number have to be reversed. In this case the values convert to - Noise: 18467 x: 586 y: 379 When the Cricut responds to commands it also sends a length byte as the first character. Remember this byte does not count as part of the received data. The received data can be formatted in a number of ways, the most common data type is a 16 bit Int or a 'short' that is made up of two bytes. The following is a response received from the Cricut for the above Mat Bounds command:

Recv: 08 01 3c 00 32 13 62 12 58

The first byte is the same described above, we are looking at a total of 9 bytes and the first one tells us to expect 8. The returned data can be interpreted as 01 3C = 316, 00 32 = 50, 13 62 = 4962, 12 58 = 4696. The focus here is on the data returned, these values are further analyzed on the Mat Bounds page. For more examples click through to each of the above commands.

Null bytes

Many commands return values that can be interpreted as null, in some programming languages these are considered to be the last character of the string. This will cause problems when these null bytes are present before the string, causing the characters to not display.

Units

Units used are one Inch is 404 x 404 (roller x stylus). These units will be referred to as ticks.The X axis is the mat movement, and the Y axis is the cutter movement.

See Also