Ruida

Introduction

Ruida controllers are laser cutter controller boards with several beefier features. They are built for lasering, and run a download and execute scheme. They are natively supported by RDWorks (which is free) and supported by Lightburn (Proprietary, $80). They have a control panel that can often display the program to be run and perform jogging operations. There have been a number of reverse engineering and supporting operations.

Ruida controllers can control 4 axises. These are X, Y, Z, and U.

Models

There are several Ruida Models which cause slightly different interactions.

644XG

Default Model.

644XS

Replying 0 to a DA0004 request causes a communication error.

320

Replying 0 to a DA0004 request causes a communication error.

633X

Replying 0 to a DA0004 request causes a communication error.

634XG

Uses an altered form of the scrambling algorithm.

The xor magic value is 0x11

654XG

Replying 0 to a DA0004 request causes a communication error.

Protocol

The laser can be controlled through a few different means. It accepts USB files in an .rd format, it can be set to listen for UDP packets on port 50200, and can directly transfer files via USB to the device.

UDP

The device listens on port 50200 on the laser, and sends from port 40200.

The payload is an RD file with the same payload, command, and syntax. It also has the same swizzling so an RD file for a 634XG will be swizzled with 0x11 and not 0x88 for the magic number.

UDP packets requires an extra 16 bit checksum for each packet. Since UDP can lose packets it requires an ACK reply after every packet. The checksum doesn't require any special operations it's literally just the lower 16 bits sum of the value of each byte in the packet. Beyond those differences the remaining elements are Ruida commands which follow a fairly well understood structure.

The first two bytes of any UDP packet are big endian checksum. This response to this is either 0xCC Checksum match or 0xCF checksum fail. On fail the packet must be resent. Too long of a time will cause a time out.

In UDP the packet size is limited to 1474 bytes. However most modern versions simply cut at around 1000 bytes. These cuts are permitted to occur mid-command but modernly do not do that. They cut at command boundaries.

There is no header, arbitration, or handshaking. Anything that is interpreted as correct will execute.

The timeout is about 4 seconds. It expects a reply ACK packet by then.

The first chunk will retry other chunks will simply fail.

The payload has an EOF command.

USB

There are two methods of USB transfer, direct transfer with a USB device between the machine and computer, and through the use of a thumb drive.

When plugged in to USB it uses USB 1.1 at full speed. The connected communications chip is the FT245R chip. This uses a standard communications serial port.

• 19200 bps
• 8 data bits
• No parity
• 1 stop bit
• hardware flow control [1]

Swizzling

All packet data is lightly swizzled at the byte level. The checksum is calculated preswizzle.

    644XG - Magic = 0x88
    644XS - Magic = 0x88
    320 - Magic = 0x88
    633X - Magic = 0x88
    634XG - Magic = 0x11
    654XG - Magic = 0x88
    RDL9635 - Magic = 0x38 [2]

Swizzling:

       b ^= (b >> 7) & 0xFF
       b ^= (b << 7) & 0xFF
       b ^= (b >> 7) & 0xFF
       b ^= magic
       b = (b + 1) & 0xFF

Unswizzling:

       b = (b - 1) & 0xFF
       b ^= magic
       b ^= (b >> 7) & 0xFF
       b ^= (b << 7) & 0xFF
       b ^= (b >> 7) & 0xFF
       return b

The general algorithm swaps the first and last digit, xors the data and adds 1. The reverse unswizzling requires subtracting one, xor, and swapping the first and last digit. In the presented code the swap is done there with an xor swap.

Ruida Encoding

The UDP and USB modes perform some jogging and realtime controls and data queries but mostly send .rd files.

Structure

The basic structure of an .rd file is a header and body.

Header

The header has two main sections, the main header, and the layer headers.

The main header sets the origin point, and the bounding boxes for the entire project. And some unknown information.

    --> d812
    --> f0
    --> f10200
    --> d800
    --> e70600000000000000000000 (0.000000,0.000000)
    --> e70300000000000000000000 (MinX: 0.000000 MinY: 0.000000)
    --> e70700000e6c780000125c66 (MaxX: 9579.527559 MaxY: 12078.346457)
    --> e75000000000000000000000 (MinX: 0.000000 MinY: 0.000000)
    --> e75100000e6c780000125c66 (MaxX: 9579.527559 MaxY: 12078.346457)
    --> e7040001000100000000000000000000 (unknown)
    --> e70500 (unknown)

Each layer header corresponds to the Work information in RDWorks this conveys the information of the speed to travel at, the min power, several other power values, And the color of that layer.

These are all layer 0:

    --> c904000000060d20 (Speed=100.000000)
    --> c631001175 (Power 1 min=13.995361%)
    --> c632001704 (Power 1 min=13.995361%)
    --> c641002632 (Power 2 min=29.992676%)
    --> c642002632 (Power 2 max=29.992676%)
    --> c635002632 (Power 3 min=29.992676%)
    --> c636002632 (Power 3 max=29.992676%)
    --> c637002632 (Power 4 min =29.992676%)
    --> c638002632 (Power 4 max=29.992676%)
    --> ca06000000000000 (Color=#000000)
    --> ca410000 (Unknown)
    --> e7520000000000000000000000 (MinX: 0.000000 MinY: 0.000000)
    --> e7530000000532320000066a08 (MinX: 3479.133858 MaxY: 4404.724409)
    --> e7610000000000000000000000 (MinX: 0.000000 MinY: 0.000000)
    --> e7620000000532320000066a08 (MaxX: 3479.133858 MaxY: 4404.724409)

Body

The body intros with a series of prestart commands before beginning the first layer.

-> f10300000000000000000000 F1 03 (0.000000,0.000000) --> f10000 F1 00 (0) --> f10100 F1 01 (0) --> f20000 F2 00 (0) --> f20100 F2 01 (0) --> f202052a391c41046a150820 F2 02 (?) --> f20300000000000000000000 F2 03 (0.000000,0.000000) --> f20400000e6c730000125c68 F2 04 (9579.330709,12078.425197) --> f20600000000000000000000 F2 06 (0.000000,0.000000) --> f20700 F2 07 (0) --> f205000100017f7f71130d0000125c68 F2 05 --> ea00 EA (0) --> e76000 E7 60 (0) --> e71300000000000000000000 E7 13 (0.000000,0.000000) --> e71700000e6c730000125c68 E7 17 (9579.330709,12078.425197) --> e72300000000000000000000 E7 23 (0.000000,0.000000) --> e72400 E7 24 (0) --> e708000100017f7f71130d0000125c68 E7 08 --> ca0100 --> ca0200 Part 0, Start Layer --> ca0130 CA 01 30, Unknown. --> ca0110 Unknown CA 01 command. --> ca0113 Air Assist On. --> c9020000060d20 Speed set at 100.000000 --> c6150000000000 C6 15 --> c6160000000000 C6 16 --> c6011175 (1st laser source min power: 13) --> c6021704 (1st laser source max power: 17) --> c6212632 (2nd laser source min power: 29) --> c6222632 (2nd laser source max power: 29) --> c6052632 (c6 05 power: 29.992676) --> c6062632 (c6 06 power: 29.992676) --> c6072632 (c6 07 power: 29.992676) --> c6082632 (c6 08 power: 29.992676) --> ca030d Unknown CA 03 Command.

Data Types

Each command in Ruida starts with a a high bit meaning all bytes sent that are 0x80 or above are commands. All other bytes consequently cannot use that bit. This leads to the two other main unit types.

• 7 bit integer. (1 byte)
• 14 bit signed integer. (2 bytes)
• 14 bit unsigned integer. (2 bytes)
• 32 bit signed number (5 bytes)
• 32 bit unsigned number. (5 bytes)
• c_string null terminated value. (n+1 bytes)

The 32 bit numbers require 5 bytes (5 * 7 bits) which gives 35 bits. The top three are simply ignored. These are zeroed so for signed versions it must be signed at the 32nd bit.

Absolute Coordinate. 5 Bytes. 32 bit signed. This is stored as a signed 32 bit integer 5 byte integer. The distance is in micrometers. This is relative to the Job Origin.

Relative Coordinate. 2 bytes. 14 bit signed. This is stored as a signed 14 bit integer 2 byte integer. The distance is in micrometers.

Speed. 5 bytes. 32 bits. Speed in micrometers.

Percent. 2 bytes. 14 bits. 100 / (2 ^ 14).

LongInt: 35 bit integer.

0x88 Move Absolute (11 bytes)

0x88 is 2 absolute coordinate for X and Y. The command is:

• 88 XX XX XX XX XX YY YY YY YY YY

0x89 Move Relative (5 bytes)

0x89 is 2 relative coordinates for x and Y. The command is:

• 89 XX XX YY YY

0x8A Horizontal Move Relative (3 Bytes)

0x8A is 1 relative coordinate for X. The command is:

8A XX XX - 3 bytes

0x8B Vertical Move Relative (3 Bytes)

0x8B is 1 relative coordinate for Y. The command is:

8B YY YY

0xA8 Cut Absolute (11 bytes)

0xA8 is 2 absolute coordinates for X and Y. The command is:

0xA8 XX XX XX XX XX YY YY YY YY YY

0xA9 Cut Relative (5 bytes)

0xA9 is 2 relative coordinates for x and Y. The command is:

• A9 XX XX YY YY

0xAA Horizontal Cut Relative (3 bytes)

0xAA is 1 relative coordinate for X. The command is:

AA XX XX - 3 bytes

0xAB Vertical Cut Relative (3 bytes)

0xAB is 1 relative coordinate for Y. The command is:

AB YY YY

0xC6 Set Property

0xC6 sets a particular properties some are known, some are not.

The commands 0x01 and 0x02 are power settings so is 0x31 and 0x32 except that that is at the layer level and sets the power for that part in particular. We can also tell many unknowns like 0x05 and 0x07 reflect 0x35 and 0x37 but with 1 extra byte which is likely also marking the layer/part number.

• 0x01 <Power> -- Sets Power1 Minimum. (Non-first property)
• 0x02 <Power> -- Sets Power1 Maximum. (Non-first property)
• 0x05 <2 bytes> -- Unknown.
• 0x07 <2 bytes> -- Unknown.
• 0x08 <2 bytes> -- Unknown.
• 0x12 <5 bytes> -- Unknown. Seen in raster 1.
• 0x13 <5 bytes> -- Unknown. Seen in raster 2.
• 0x15 -- Unknown
• 0x16 -- Unknown
• 0x21 <Power> -- Sets Power2 Minimum.
• 0x22 <Power> -- Sets Power2 Maximum.
• 0x31 <Part> <Percent> - Property Min-Power - #1 in sequence (first property)
• 0x32 <Part> <Percent> - Property Power - #2 in sequence (first Property)
• 0x35 <3 bytes> - Unknown. #5 in sequence
• 0x36 <3 bytes> - Unknown. #6 in sequence
• 0x37 <3 bytes> - Unknown. #7 in sequence
• 0x38 <3 bytes> - Unknown. #8 in sequence
• 0x41 <3 bytes> - Unknown. #4 in sequence
• 0x42 <3 bytes> - Unknown. #5 in sequence
• 0x60 <Part> 0x00 <LongInt> - Set Frequency.

0xC9 Set Speed

0xC9 set the speed. Speeds are in micrometers / sec.

• 0x02 <Speed> - 7 bytes Sets Speed.

• 0x04 0x00 <Speed> - 8 bytes

0xCA Unknown Set Coords?

Part - 1 byte integer listing the byte layer.

• 0x01 0x00 - Unknown.
• 0x01 0x13 - Air Assist On.
• 0x02 <part> - Start Layer
• 0x03 0x0F - Start Vector Mode.
• 0x06 <Part> <5 bytes> -- Set color. BBGGRR
• 0x10 0x00 - Start Vector Mode2.
• 0x22 <1 byte>
• 0x41 <Part> <1 Byte> -- Unknown.

0xCC ACK

Acknowledgment from Machine.

0xCD ERROR

Error from the machine

0xD7 Finishing

0xD7 - End of File. (Seen last).

0xD8 Unknown Program

These elements are only seen when planning on starting some programmed cuts.

• 0x00 -- #5 seen in sequence.
• 0x12 -- #1 seen in sequence.
• 0x2C -- Home the Z axis.
• 0x2D -- Home the U axis.
• 0x2E -- Focus.

0xD9 Jog Move.

• PARAM 1 Byte:

   * 0x00 (Origin) Move with Origin.
   * 0x01 (Light/Origin) Move with Light and Origin.
   * 0x02 () Move
   * 0x03 (Light) Move with Light On

• 0x00 <PARAM> <ABSCOORD> -- Move X
• 0x01 <PARAM> <ABSCOORD> -- Move Y
• 0x02 <PARAM> <ABSCOORD> -- Move Z
• 0x03 <PARAM> <ABSCOORD> -- Move U
• 0x10 <PARAM> Home XY

0xDA Data Exchange

Requests data from the machine. To work successfully the reply to 05 7E is 0x65006500.

• IO 1 Byte

   * 0x00 Requesting Data.
   * 0x01 Sending Data.

• 0xDA <IO=0x00> <2 Byte>
• 0xDA <IO=0x01>

The data between the two flows both ways between program and controller.

Data Byte 0x00

• 0x04: Item 1 and 6 in the preamble for most commands. Replying 0 to this for the 644XS causes a communication error.
• 0x05: Unknown
• 0x10: Startup 1. First request on starting of RDWorks.
• 0x1E: Startup 2. Second request on starting of RDWorks.
• 0x20: X Position Request.
• 0x21: Item 4 in the preamble for most commands.
• 0x26: Item 2 in the preamble for most commands.
• 0x30: Y Position Request.
• 0x31: Item 5 in the preamble for most commands.
• 0x36: Item 3 in the preamble for most commands.
• 0x40: Z Position Request.
• 0x50: U Position Request.

Data Byte 0x04

• 0x00: Reply 0x22. Unknown but replying 0x22 is known.
• 0x05: Previous Work Time. Work time in seconds.
• 0x08: Previous Work Time2. Work time in seconds.
• 0x21: Position X.
• 0x31: Position Y.
• 0x41: Position Z.
• 0x51: Position U.

Data Byte 0x05

• 0x7E: Reply must be 0x65006500 or things go poorly.

Data Byte 0x06

This is sent by RDWorks to the Cutter with a value of 0 at the end of a program.

• 0x20 <long_int> <long_int>: Set Work Interval.

Data Byte 0x0B

• 0x12: Item 5B in the preamble for most commands. (Sometimes this is 5th item).

0xE7 Program Items

• filename is a c-string some number of characters followed with a 0x00

• 0xE7 0x00 - Stop.
• 0xE7 0x01 <* bytes> 0x00 - <c_string: filename for transfer>
• 0xE7 0x03 <10 bytes> - Bounding Box (MinX, MinY)
• 0xE7 0x04 <15 bytes> - Program Item 11
• 0xE7 0x05 <1 byte> - Program Item 12
• 0xE7 0x06 <10 bytes> - Program Item 6
• 0xE7 0x07 <12 bytes> - Bounding Box (MaxX, MaxY)
• 0xE7 0x13 <10 bytes> - Unknown
• 0xE7 0x17 <10 bytes> - Unknown
• 0xE7 0x23 <10 bytes> - Unknown
• 0xE7 0x24 <1 byte> - Unknown
• 0xE7 0x50 <10 bytes> - Bounding Box (MinX, MaxX)
• 0xE7 0x51 <10 bytes> - Bounding Box (MaxX, MaxY)
• 0xE7 0x52 <10 bytes> - Coord 52
• 0xE7 0x53 <10 bytes> - Coord 53
• 0xE7 0x54 <1 byte: 0x00 or 0x01> <5 bytes> - Coord 54
• 0xE7 0x55 <1 byte: 0x00 or 0x01> <5 bytes> - Coord 55
• 0xE7 0x60 <1 byte> - Unknown
• 0xE7 0x61 <10 bytes> - Coord 61
• 0xE7 0x62 <10 bytes> - Coord 62

0xE8 File Transfer

• File Number is a 14 bit integer
• filename is a c-string some number of characters followed with a 0x00

• 0xE8 0x01 <filenumber> <c_string filename>
• 0xE8 0x02 This is followed by the 0xE7 0x01

0xEA Unknown

• 0xEA <1 byte> Unknown.

0xEB End Cut

• 0xEB - Finish. (Ends Cutting commands.)

0xF0 Program Item 2

• 0xF0 - Program Item 2

0xF1 Unknown

• 0xF1 0x00 <1 Byte> - Unknown.
• 0xF1 0x01 <1 Byte> - Unknown.
• 0xF1 0x02 <1 byte> - Program Item 3
• 0xF1 0x03 <10 bytes> - Unknown
• 0xF1 0x04 <1 byte> - Program Item 4
• 0xF1 0x20 <2 bytes> - Unknown.

0xF2 Unknown

• 0xF2 0x00 <1 Byte> - Unknown.
• 0xF2 0x01 <1 Byte> - Unknown.
• 0xF2 0x02 <10 bytes> - Unknown.
• 0xF2 0x03 <10 bytes> - Unknown.
• 0xF2 0x04 <10 bytes> - Unknown.
• 0xF2 0x05 <12 bytes> - Unknown. (This value is the same as E7 07 value.)
• 0xF2 0x06 <12 bytes> - Unknown
• 0xF2 0x07 <1 byte> - Unknown.

Links

Official

• ThunderLaser

Other Sources

• Roger Clarke Network Aware Laser Cutter Security.
• Fablab - Detail Rich Ruida Breakdown.
• Reverse Engineering of Laser Cutter Controller RDLxxx and RDCAM Software