Ruida

Introduction

Ruida controllers are laser cutter controller boards with several beefier features. They are built for lasering, and run a download and execute scheme. They are natively supported by RDWorks (which is free) and supported by Lightburn (Proprietary, $80). They have a control panel that can often display the program to be run and perform jogging operations. There have been a number of reverse engineering and supporting operations.

Ruida controllers can control 4 axises. These are X, Y, Z, and U.

Models

There are several Ruida Models which cause slightly different interactions.

644XG

Default Model.

644XS

Replying 0 to a DA0004 request causes a communication error.

320

Replying 0 to a DA0004 request causes a communication error.

633X

Replying 0 to a DA0004 request causes a communication error.

634XG

Uses an altered form of the scrambling algorithm.

The xor magic value is 0x11

654XG

Replying 0 to a DA0004 request causes a communication error.

Protocol

The laser can be controlled through a few different means. It accepts USB files in an .rd format, it can be set to listen for UDP packets on port 50200, and can directly transfer files via USB to the device.

UDP

The device listens on port 50200 on the laser, and sends from port 40200.

The payload is an RD file with the same payload, command, and syntax. It also has the same swizzling so an RD file for a 634XG will be swizzled with 0x11 and not 0x88 for the magic number.

UDP packets requires an extra 16 bit checksum for each packet. Since UDP can lose packets it requires an ACK reply after every packet. The checksum doesn't require any special operations it's literally just the lower 16 bits sum of the value of each byte in the packet. Beyond those differences the remaining elements are Ruida commands which follow a fairly well understood structure.

The first two bytes of any UDP packet are big endian checksum. This response to this is either 0xCC Checksum match or 0xCF checksum fail. On fail the packet must be resent. Too long of a time will cause a time out.

In UDP the packet size is limited to 1474 bytes. However most modern versions simply cut at around 1000 bytes. These cuts are permitted to occur mid-command but modernly do not do that. They cut at command boundaries.

There is no header, arbitration, or handshaking. Anything that is interpreted as correct will execute.

The timeout is about 4 seconds. It expects a reply ACK packet by then.

The first chunk will retry other chunks will simply fail.

The payload has an EOF command.

USB

There are two methods of USB transfer, direct transfer with a USB device between the machine and computer, and through the use of a thumb drive.

When plugged in to USB it uses USB 1.1 at full speed. The connected communications chip is the FT245R chip. This uses a standard communications serial port.

• 19200 bps
• 8 data bits
• No parity
• 1 stop bit
• hardware flow control [1]

Swizzling

All packet data is lightly swizzled at the byte level. The checksum is calculated preswizzle.

    644XG - Magic = 0x88
    644XS - Magic = 0x88
    320 - Magic = 0x88
    633X - Magic = 0x88
    634XG - Magic = 0x11
    654XG - Magic = 0x88
    RDL9635 - Magic = 0x38 [2]

Swizzling:

       b ^= (b >> 7) & 0xFF
       b ^= (b << 7) & 0xFF
       b ^= (b >> 7) & 0xFF
       b ^= magic
       b = (b + 1) & 0xFF

Unswizzling:

       b = (b - 1) & 0xFF
       b ^= magic
       b ^= (b >> 7) & 0xFF
       b ^= (b << 7) & 0xFF
       b ^= (b >> 7) & 0xFF
       return b

The general algorithm swaps the first and last digit, xors the data and adds 1. The reverse unswizzling requires subtracting one, xor, and swapping the first and last digit. In the presented code the swap is done there with an xor swap.

Ruida Encoding

The UDP and USB modes perform some jogging and realtime controls and data queries but mostly send .rd files.

Structure

The basic structure of an .rd file is a header and body.

Header

The header has two main sections, the main header, and the layer headers.

The main header sets the origin point, and the bounding boxes for the entire project. And some unknown information.

    --> d812
    --> f0
    --> f10200
    --> d800
    --> e70600000000000000000000 (0.000000,0.000000)
    --> e70300000000000000000000 (MinX: 0.000000 MinY: 0.000000)
    --> e70700000e6c780000125c66 (MaxX: 9579.527559 MaxY: 12078.346457)
    --> e75000000000000000000000 (MinX: 0.000000 MinY: 0.000000)
    --> e75100000e6c780000125c66 (MaxX: 9579.527559 MaxY: 12078.346457)
    --> e7040001000100000000000000000000 (unknown)
    --> e70500 (unknown)

Each layer header corresponds to the Work information in RDWorks this conveys the information of the speed to travel at, the min power, several other power values, And the color of that layer.

These are all layer 0:

    --> c904000000060d20 (Speed=100.000000)
    --> c631001175 (Power 1 min=13.995361%)
    --> c632001704 (Power 1 min=13.995361%)
    --> c641002632 (Power 2 min=29.992676%)
    --> c642002632 (Power 2 max=29.992676%)
    --> c635002632 (Power 3 min=29.992676%)
    --> c636002632 (Power 3 max=29.992676%)
    --> c637002632 (Power 4 min =29.992676%)
    --> c638002632 (Power 4 max=29.992676%)
    --> ca06000000000000 (Color=#000000)
    --> ca410000 (Unknown)
    --> e7520000000000000000000000 (MinX: 0.000000 MinY: 0.000000)
    --> e7530000000532320000066a08 (MinX: 3479.133858 MaxY: 4404.724409)
    --> e7610000000000000000000000 (MinX: 0.000000 MinY: 0.000000)
    --> e7620000000532320000066a08 (MaxX: 3479.133858 MaxY: 4404.724409)

Body

The body intros with a series of prestart commands before beginning the first layer.

   --> f10300000000000000000000    F1 03 (0.000000,0.000000)
   --> f10000    F1 00 (0)
   --> f10100    F1 01 (0)
   --> f20000    F2 00 (0)
   --> f20100    F2 01 (0)
   --> f202052a391c41046a150820    F2 02 (?)
   --> f20300000000000000000000    F2 03 (0.000000,0.000000)
   --> f20400000e6c730000125c68    F2 04 (9579.330709,12078.425197)
   --> f20600000000000000000000    F2 06 (0.000000,0.000000)
   --> f20700    F2 07 (0)
   --> f205000100017f7f71130d0000125c68    F2 05
   --> ea00    EA (0)
   --> e76000    E7 60 (0)
   --> e71300000000000000000000    E7 13 (0.000000,0.000000)
   --> e71700000e6c730000125c68    E7 17 (9579.330709,12078.425197)
   --> e72300000000000000000000    E7 23 (0.000000,0.000000)
   --> e72400    E7 24 (0)
   --> e708000100017f7f71130d0000125c68    E7 08
   --> ca0100
   --> ca0200    Part 0, Start Layer
   --> ca0130    CA 01 30, Unknown.
   --> ca0110    Unknown CA 01 command.
   --> ca0113    Air Assist On.
   --> c9020000060d20    Speed set at 100.000000
   --> c6150000000000    C6 15
   --> c6160000000000    C6 16
   --> c6011175    (1st laser source min power: 13)
   --> c6021704    (1st laser source max power: 17)
   --> c6212632    (2nd laser source min power: 29)
   --> c6222632    (2nd laser source max power: 29)
   --> c6052632    (c6 05 power: 29.992676)
   --> c6062632    (c6 06 power: 29.992676)
   --> c6072632    (c6 07 power: 29.992676)
   --> c6082632    (c6 08 power: 29.992676)
   --> ca030d    Unknown CA 03 Command.

Data Types

Each command in Ruida starts with a a high bit meaning all bytes sent that are 0x80 or above are commands. All other bytes consequently cannot use that bit. This leads to the two other main unit types.

• 7 bit integer. (1 byte)
• 14 bit signed integer. (2 bytes)
• 14 bit unsigned integer. (2 bytes)
• 32 bit signed number (5 bytes)
• 32 bit unsigned number. (5 bytes)
• c_string null terminated value. (n+1 bytes)

The 32 bit numbers require 5 bytes (5 * 7 bits) which gives 35 bits. The top three are simply ignored. These are zeroed so for signed versions it must be signed at the 32nd bit.

Absolute Coordinate. 5 Bytes. 32 bit signed. This is stored as a signed 32 bit integer 5 byte integer. The distance is in micrometers. This is relative to the Job Origin.

Relative Coordinate. 2 bytes. 14 bit signed. This is stored as a signed 14 bit integer 2 byte integer. The distance is in micrometers.

Speed. 5 bytes. 32 bits. Speed in micrometers.

Percent. 2 bytes. 14 bits. 100 / (2 ^ 14).

LongInt: 35 bit integer.

0x88 Move Absolute (11 bytes)

0x88 is 2 absolute coordinate for X and Y. The command is:

• 88 XX XX XX XX XX YY YY YY YY YY

0x89 Move Relative (5 bytes)

0x89 is 2 relative coordinates for x and Y. The command is:

• 89 XX XX YY YY

0x8A Horizontal Move Relative (3 Bytes)

0x8A is 1 relative coordinate for X. The command is:

8A XX XX - 3 bytes

0x8B Vertical Move Relative (3 Bytes)

0x8B is 1 relative coordinate for Y. The command is:

8B YY YY

0xA8 Cut Absolute (11 bytes)

0xA8 is 2 absolute coordinates for X and Y. The command is:

0xA8 XX XX XX XX XX YY YY YY YY YY

0xA9 Cut Relative (5 bytes)

0xA9 is 2 relative coordinates for x and Y. The command is:

• A9 XX XX YY YY

0xAA Horizontal Cut Relative (3 bytes)

0xAA is 1 relative coordinate for X. The command is:

AA XX XX - 3 bytes

0xAB Vertical Cut Relative (3 bytes)

0xAB is 1 relative coordinate for Y. The command is:

AB YY YY

0xC6 Set Property

0xC6 sets a particular properties some are known, some are not.

The commands 0x01 and 0x02 are power settings so is 0x31 and 0x32 except that that is at the layer level and sets the power for that part in particular. We can also tell many unknowns like 0x05 and 0x07 reflect 0x35 and 0x37 but with 1 extra byte which is likely also marking the layer/part number.

• 0x01 <Power> -- Sets Power1 Minimum. (Non-first property)
• 0x02 <Power> -- Sets Power1 Maximum. (Non-first property)
• 0x05 <2 bytes> -- Unknown.
• 0x07 <2 bytes> -- Unknown.
• 0x08 <2 bytes> -- Unknown.
• 0x12 <5 bytes> -- Unknown. Seen in raster 1.
• 0x13 <5 bytes> -- Unknown. Seen in raster 2.
• 0x15 -- Unknown
• 0x16 -- Unknown
• 0x21 <Power> -- Sets Power2 Minimum.
• 0x22 <Power> -- Sets Power2 Maximum.
• 0x31 <Part> <Percent> - Property Min-Power - #1 in sequence (first property)
• 0x32 <Part> <Percent> - Property Power - #2 in sequence (first Property)
• 0x35 <3 bytes> - Unknown. #5 in sequence
• 0x36 <3 bytes> - Unknown. #6 in sequence
• 0x37 <3 bytes> - Unknown. #7 in sequence
• 0x38 <3 bytes> - Unknown. #8 in sequence
• 0x41 <3 bytes> - Unknown. #4 in sequence
• 0x42 <3 bytes> - Unknown. #5 in sequence
• 0x60 <Part> 0x00 <LongInt> - Set Frequency.

0xC9 Set Speed

0xC9 set the speed. Speeds are in micrometers / sec.

• 0x02 <Speed> - 7 bytes Sets Speed.

• 0x04 0x00 <Speed> - 8 bytes

0xCA Unknown Set Coords?

Part - 1 byte integer listing the byte layer.

• 0x01 0x00 - Unknown.
• 0x01 0x13 - Air Assist On.
• 0x02 <part> - Start Layer
• 0x03 0x0F - Start Vector Mode.
• 0x06 <Part> <5 bytes> -- Set color. BBGGRR
• 0x10 0x00 - Start Vector Mode2.
• 0x22 <1 byte>
• 0x41 <Part> <1 Byte> -- Unknown.

0xCC ACK

Acknowledgment from Machine.

0xCD ERROR

Error from the machine

0xD7 Finishing

0xD7 - End of File. (Seen last).

0xD8 Unknown Program

These elements are only seen when planning on starting some programmed cuts.

• 0x00 -- #5 seen in sequence.
• 0x12 -- #1 seen in sequence.
• 0x2C -- Home the Z axis.
• 0x2D -- Home the U axis.
• 0x2E -- Focus.

0xD9 Jog Move.

• PARAM 1 Byte:

   * 0x00 (Origin) Move with Origin.
   * 0x01 (Light/Origin) Move with Light and Origin.
   * 0x02 () Move
   * 0x03 (Light) Move with Light On

• 0x00 <PARAM> <ABSCOORD> -- Move X
• 0x01 <PARAM> <ABSCOORD> -- Move Y
• 0x02 <PARAM> <ABSCOORD> -- Move Z
• 0x03 <PARAM> <ABSCOORD> -- Move U
• 0x10 <PARAM> Home XY

0xDA Data Exchange

Requests data from the machine. To work successfully the reply to 05 7E is 0x65006500.

Byte 0	Byte 1	Meaning
0xDA	0x00	Query <Key_Value>
0xDA	0x01	Set <Key_Value>

The data flows both ways between host and controller.

Byte 0	Byte 1	Key_Value
0x04	0x03	Acc G0 Ratio
0x02	0x1A	Acc Ratio
0x02	0x17	Array Feed Repay
0x00	0x1e	Auto Type Space
0x00	0x2B	Axis Backlash 1
0x00	0x3B	Axis Backlash 2
0x00	0x4B	Axis Backlash 3
0x00	0x5B	Axis Backlash 4
0x00	0x28	Axis Btn Acc 1
0x00	0x38	Axis Btn Acc 2
0x00	0x48	Axis Btn Acc 3
0x00	0x58	Axis Btn Acc 4
0x00	0x27	Axis Btn Strt Vel 1
0x00	0x37	Axis Btn Strt Vel 2
0x00	0x47	Axis Btn Strt Vel 3
0x00	0x57	Axis Btn Strt Vel 4
0x00	0x29	Axis Estp Acc 1
0x00	0x39	Axis Estp Acc 2
0x00	0x49	Axis Estp Acc 3
0x00	0x59	Axis Estp Acc 4
0x00	0x2A	Axis Home Offset 1
0x00	0x3A	Axis Home Offset 2
0x00	0x4A	Axis Home Offset 3
0x00	0x5A	Axis Home Offset 4
0x00	0x25	Axis Max Acc 1
0x00	0x35	Axis Max Acc 2
0x00	0x45	Axis Max Acc 3
0x00	0x55	Axis Max Acc 4
0x00	0x23	Axis Max Velocity 1
0x00	0x33	Axis Max Velocity 2
0x00	0x43	Axis Max Velocity 3
0x00	0x53	Axis Max Velocity 4
0x00	0x21	Axis Precision 1
0x00	0x31	Axis Precision 2
0x00	0x41	Axis Precision 3
0x00	0x51	Axis Precision 4
0x00	0x26	Axis Range 1
0x00	0x36	Axis Range 2
0x00	0x46	Axis Range 3
0x00	0x56	Axis Range 4
0x00	0x24	Axis Strt Velocity 1
0x00	0x34	Axis Strt Velocity 2
0x00	0x44	Axis Strt Velocity 3
0x00	0x54	Axis Strt Velocity 4
0x03	0x00	Card Language
0x0b	0x11	Card Lock
0x02	0x37	Eng Acc Ratio (0-200)
0x0B	0x??	Eng Facula
0x0E	0x??	Eng Vert Velocity
0x02	0x07	Feed Delay After
0x02	0x0b	Feed Delay Prior
0x02	0x0e	Focus Depth
0x02	0x0a	G0 Acc
0x02	0x03	G0 Delay
0x00	0x05	G0 Velocity
0x02	0x0f	Go Scale Blank
0x00	0x0c	Home Velocity
0x00	0x16	Laser Attenuation
0x00	0x13	Max Power 1
0x00	0x19	Max Power 2
0x00	0x64	Max Power 3
0x00	0x69	Max Power 4
0x00	0x12	Min Power 1
0x00	0x18	Min Power 2
0x00	0x63	Min Power 3
0x00	0x68	Min Power 4
0x00	0x11	Laser PWM Frequency 1
0x00	0x17	Laser PWM Frequency 2
0x00	0x65	Laser PWM Frequency 3
0x00	0x6a	Laser PWM Frequency 4
0x00	0x1a	Laser Standby Frequency 1
0x00	0x1c	Laser Standby Frequency 2
0x00	0x66	Laser Standby Frequency 3
0x00	0x6B	Laser Standby Frequency 4
0x00	0x1b	Laser Standby Pulse 1
0x00	0x1d	Laser Standby Pulse 2
0x00	0x67	Laser Standby Pulse 3
0x00	0x6C	Laser Standby Pulse 4
0x60	0x1155	Set Machine Type (54, 55)
0x60	0xaa55	Set Machine Type (22, 55)
0x02	0x0c	Manual Dis
0x02	0x31	Manual Fast Speed
0x02	0x32	Manual Slow Speed
0x03	0x01 - 0x08	PC Lock
0x04	0x08	Pre Work Time
0x02	0x21	Rotate D
0x02	0x1F	Rotate Pulse
0x02	0x0D	Shut Down Delay
0x02	0x02	Syn Acc
0x10	0x??	System Control Mode
0x02	0x??	System Settings
0x04	0x11	Total Laser Work Time
0x04	0x01	Total Open Time
0x04	0x23	Total Work Length
0x04	0x03	Total Work Number
0x04	0x02	Total Work Time
0x02	0x09	Turn Acc
0x02	0x1B	Turn Ratio
0x02	0x01	Turn Velocity
0x06	0x00	U Home Velocity
0x02	0x26	User Para 1
0x02	0x2D	U Work Velocity
0x02	0x25	X Eng Acc
0x02	0x24	X Minimum Eng Velocity
0x02	0x35	Y Eng Acc
0x02	0x34	Y Minimum Eng Velocity
0x02	0x2A	Z G0 Velocity
0x02	0x28	Z Home Velocity
0x02	0x2B	Z Pen Up Position
0x02	0x29	Z Work Velocity
0x07	0x10-0x74	Document Time
0x04	0x00	Machine Status (0b00110111 relevant bits).

Machine Status:

    0x10 = IsMove

Data Byte 0x00

• 0x04: Item 1 and 6 in the preamble for most commands. Replying 0 to this for the 644XS causes a communication error.
• 0x05: Unknown
• 0x10: Startup 1. First request on starting of RDWorks.
• 0x1E: Startup 2. Second request on starting of RDWorks.
• 0x20: X Position Request.
• 0x21: Item 4 in the preamble for most commands.
• 0x26: Item 2 in the preamble for most commands.
• 0x30: Y Position Request.
• 0x31: Item 5 in the preamble for most commands.
• 0x36: Item 3 in the preamble for most commands.
• 0x40: Z Position Request.
• 0x50: U Position Request.

Data Byte 0x04

• 0x00: Reply 0x22. Unknown but replying 0x22 is known.
• 0x05: Previous Work Time. Work time in seconds.
• 0x08: Previous Work Time2. Work time in seconds.
• 0x21: Position X.
• 0x31: Position Y.
• 0x41: Position Z.
• 0x51: Position U.

Data Byte 0x05

• 0x7E: Reply must be 0x65006500 or things go poorly.

Data Byte 0x06

This is sent by RDWorks to the Cutter with a value of 0 at the end of a program.

• 0x20 <long_int> <long_int>: Set Work Interval.

Data Byte 0x0B

• 0x12: Item 5B in the preamble for most commands. (Sometimes this is 5th item).

0xE7 Program Items

• filename is a c-string some number of characters followed with a 0x00

• 0xE7 0x00 - Stop.
• 0xE7 0x01 <* bytes> 0x00 - <c_string: filename for transfer>
• 0xE7 0x03 <10 bytes> - Bounding Box (MinX, MinY)
• 0xE7 0x04 <15 bytes> - Program Item 11
• 0xE7 0x05 <1 byte> - Program Item 12
• 0xE7 0x06 <10 bytes> - Program Item 6
• 0xE7 0x07 <12 bytes> - Bounding Box (MaxX, MaxY)
• 0xE7 0x13 <10 bytes> - Unknown
• 0xE7 0x17 <10 bytes> - Unknown
• 0xE7 0x23 <10 bytes> - Unknown
• 0xE7 0x24 <1 byte> - Unknown
• 0xE7 0x50 <10 bytes> - Bounding Box (MinX, MaxX)
• 0xE7 0x51 <10 bytes> - Bounding Box (MaxX, MaxY)
• 0xE7 0x52 <10 bytes> - Coord 52
• 0xE7 0x53 <10 bytes> - Coord 53
• 0xE7 0x54 <1 byte: 0x00 or 0x01> <5 bytes> - Coord 54
• 0xE7 0x55 <1 byte: 0x00 or 0x01> <5 bytes> - Coord 55
• 0xE7 0x60 <1 byte> - Unknown
• 0xE7 0x61 <10 bytes> - Coord 61
• 0xE7 0x62 <10 bytes> - Coord 62

0xE8 File Transfer

• File Number is a 14 bit integer
• filename is a c-string some number of characters followed with a 0x00

• 0xE8 0x01 <filenumber> <c_string filename>
• 0xE8 0x02 This is followed by the 0xE7 0x01

0xEA Unknown

• 0xEA <1 byte> Unknown.

0xEB End Cut

• 0xEB - Finish. (Ends Cutting commands.)

0xF0 Program Item 2

• 0xF0 - Program Item 2

0xF1 Unknown

• 0xF1 0x00 <1 Byte> - Unknown.
• 0xF1 0x01 <1 Byte> - Unknown.
• 0xF1 0x02 <1 byte> - Program Item 3
• 0xF1 0x03 <10 bytes> - Unknown
• 0xF1 0x04 <1 byte> - Program Item 4
• 0xF1 0x20 <2 bytes> - Unknown.

0xF2 Unknown

• 0xF2 0x00 <1 Byte> - Unknown.
• 0xF2 0x01 <1 Byte> - Unknown.
• 0xF2 0x02 <10 bytes> - Unknown.
• 0xF2 0x03 <10 bytes> - Unknown.
• 0xF2 0x04 <10 bytes> - Unknown.
• 0xF2 0x05 <12 bytes> - Unknown. (This value is the same as E7 07 value.)
• 0xF2 0x06 <12 bytes> - Unknown
• 0xF2 0x07 <1 byte> - Unknown.

Links

Official

• ThunderLaser

Other Sources

• Roger Clarke Network Aware Laser Cutter Security.
• Fablab - Detail Rich Ruida Breakdown.
• Reverse Engineering of Laser Cutter Controller RDLxxx and RDCAM Software