We picked up a 60W fibre laser after we were looking for some stuff and saw a youtube video on MOPA lasering…
Fast forward to the arrival, it got stuck in customs partly due to FDA, partly due to the time of year, we picked it up from Kelly @ Wuhan Optical which of course has its own drama right after the New Years break with the virus. Which meant even though it’d been in customs for a while, it was very carefully disinfected with alcohol etc during unpacking.
After setup we fired up the laser and did some tests.
60W MOPA Fibre laser, it is a tasty piece of kit
There is bunch of stuff to setup in the configs and try to tune it to the coloured metal output. Like this! Amazing stuff.
Pretty neat
Stainless Steel
Copper coated plastic or something
Dithered
No dither
Stainless steel 0.15mm thick
Tool Plate
Welding plate from Lowes, hard to see the colours
Block of aluminium
The Setup
Thus follows a bunch of images ( A ) to share with others, ( B ) for us to find later.. .which is half what this blog is.
Make sure you load the correct CAL file for the lense you are using, if you start EzCad2 and it says “Can’t find file” or such, it is likely missing the CAL file. Which you set the location of the in the Param(F3) menu
Settings for the actual engrave/cut.
Ok back to the blog.
The Chinese software is less than great…
Here we are again, most Chinese software actually does most of what you need, it is very focused on you can do it if you do enough fiddling around, and workarounds for 90% of the stuff it’ll cover, the make it work, and stopping before the make it great practice of software dev. But given the razor thin margins and other such things , who would be shocked ? China is really good at what they do, but it is very specific.
The first thing i notice about the software is the key (F1) to display the red safe for eyes laser to show the box or contour of the thing you’re about to lase , is right next to the KEY (F2) that actually fires the laser which is not safe for eyes… so that is a terrible design choice. so watch out for that. In China they don’t even use the protective glasses (not that the supplied ones are great, get some thorlabs ones), so they’re not worried about this issue I would imagine.
Since you can use the foot pedal to start the laser running, why not just disable F2 altogether ? I’ve already accidentally fired the laser once, but I swear I hit apply and not FIRE LASERS !!!
Motor Driver 12,800 steps setup on ours
http://www.sah.co.rs/media/sah/techdocs/dm542_manual.pdf
60w Fibre Laser data sheet
https://cdn.specpick.com/images/photonics/products/RFL-P60M.pdf
The author(me) gets distracted during this write up.
Good question, Hmmm, ok why not, I’ll pause this text typing and go and look for it..(literally just happened)
Taking a look at EzCad2.exe imports I see lots of uses of
That would be for checking the state of virtual keys, and VK_F2 is 0x71.. 0x70 is F1, is that it? Virtual Key Codes
I see, 0x10(VK_SHIFT), 17(VK_CONTROL) 164 (VK_LMENU) and 165 (VK_RMENU)
It’s looking for key modifiers which is a typical use of GetKeyState, most likely i’d look for the WinProc and see the key down/up events but we’re in MFC so it’ll likely be a handler via DDX , PreTranslateMessage, Accelerators CWnd func, etc.
Poking around to see if it is obvious which is used while running the app. I run it inside the debugger but not connected to the Laser, ahh, the keys are disabled since I have no control board connected, very sensible but less than ideal for what we’re doing here.
Looks like the standard way to enable/disable controls in MFC based on a call to the LMC Driver setup.
We can see that the dialog ID for the red laser is 17023/0x427f using Spy++
There are a few PostMessageW’s to that ID , both id 0x111 ( WM_COMMAND) with the dialog ID and 0 so menu. Seems like a thing. Which leads us to this :-
if ( wParam == 113 )
and
if ( wParam == 112)
113 and 112 are the virtual keys for F2 and F1 respectively. They each post a message to the dialog ID’s 17023 and 1321 so if this is the right spot looking at the ID for the Mark(F2) button would equal 1321
0x529 = 1321, so confirmed.
There are two places it checks that VK_ and they both call PostMessageW(hwnd, WM_COMMAND, dialogID , 0 );
Here is one location
0x04FF7DD 83 7D 0C 70 cmp [ebp+wParam], 0x70
0x04FF808 83 7D 0C 71 cmp [ebp+wParam], 0x71
Changing those should change the key, if you need to update the GUI change LANG=lang_Enu.ini
For F2
BTNMARK=Mark(F2)
CONTMARKALLPART=F2 Continuous mark all
For F1
BTNLIGHT=Red(F1)
MARKALLPART=F1 Mark all part
Also a couple of NOPs here and there will disable the key altogether! Note there are two sets of this code, this is just one.
0x04FF7DD 83 7D 0C 70 cmp [ebp+wParam], 0x70 ; VK_ Code
0x04FF7E1 75 25 jnz short loc_0x4FF808
0x04FF7E3 6A 00 push 0x0 ; lParam
0x04FF7E5 68 7F 42 00 00 push 0x427F ; wParam
0x04FF7EA 68 11 01 00 00 push 0x111 ; Msg
0x04FF7EF 8B 0D 44 AC 5B 00 mov ecx, dword_0x5BAC44
0x04FF7F5 E8 86 F2 F0 FF call GetHwnd
0x04FF7FA 50 push eax ; hWnd
0x04FF7FB FF 15 5C 1A 56 00 call ds:PostMessageW
0x04FF801 33 C0 xor eax, eax
0x04FF803 E9 E4 02 00 00 jmp loc_0x4FFAEC
0x04FF808
loc_0x4FF808:
0x04FF808 83 7D 0C 71 cmp [ebp+wParam], 0x71 ; VK Code
0x04FF80C 75 25 jnz short loc_0x4FF833
0x04FF80E 6A 00 push 0x0 ; lParam
0x04FF810 68 29 05 00 00 push 0x529 ; wParam
0x04FF815 68 11 01 00 00 push 0x111 ; Msg
0x04FF81A 8B 0D 44 AC 5B 00 mov ecx, dword_0x5BAC44
0x04FF820 E8 5B F2 F0 FF call GetHwnd
0x04FF825 50 push eax ; hWnd
0x04FF826 FF 15 5C 1A 56 00 call ds:PostMessageW
Saturday morning, I ended up writing a little app to patch the EXE and change the keys, it searches for the code sequences for the VK’s which there are two of each, so I search for three, and if it only finds two sets, adjusts the location and changes the VK code then write outs a new EXE. I added the F keys and SPACE .. Don’t use a key thats already in use! Edit the lang\lang_enu.ini for english text to change the EzCad2 GUI to match the new keys.
Warning: You should never actually use this any of this information in this post, this linked app or even test it, as it may do something bad and unexpected to everything, and anything, damage you, damage the laser, the planet, etc. Its purely for informational purposes only.
https://github.com/charlie-x/fibrelasertools
I tried this app on the actual laser, it works but there is another place where F2 is getting used so have to find that one too. I set the red mark to VK_SPACE and then use the footswitch to fire the laser, that way you dont need to tap F1 or F2, i’ll find the others.
OK we’ve gone on a journey, now we’re back to writing up the rest.
So why are we doing this
Apart from the obvious, because we can, the host software isn’t great, why not, and the other reasons
We want to make stainless steel stencils for PCB, so i try an export of the DXF directly from Eagle, the gerber tCream and various modified versions via Illustrator , using type 3 .ai files. Unfortunately the geom doesn’t close properly the stating position and ending position of everything is off so it leaves a little tab behind, drawing it in ezcad works properly its only on the dxf/gerber/ai import this happens, the geo is contiguous and closed so its something else.
Looks good, except for the one corner that isn’t cut out!
After fiddling around I poke around at the software, we’ve already updated EzCad from the version supplied. I’d like to be able to drive the laser directly so investigations begin.
Various notes i’ve found about the process
DXF import failed for R12 DXF’s AC1009 (eagle spits these out) loading in AI and exporting as DFX 2004 AC1018 worked.
Straight from Eagle R12 to EzCad2
Load into AI and export as 2004
R12 as viewed in AI
Now in EzCad2 as a 2004 DXF
Gerber import from eagle works, but pads end up as circles unless you add any rounded corner to the pads of your devices.
tCream as viewed in Eagle
tCream gerber as viewed in EzCad
The rectangular pads appear as circles, but rounded pads appear correctly. The workaround I found for this is tedious but worked
Edit the package, then the PAD properties and set roundness to something more than 0 then update the board, and re-export the gerber.
Laser fails to cut corners of shapes
This one is partly why I started this, we had a false test that allowed us to cut rectangles clearly but I think the settings changed between the working cut and then our stencil tests, basically one small tab at the end of the laser operation would be left behind.
At first since we could cut proper rectangles and only imported geo seemed to not work, it seem like it was an import issue. But revisiting we decided to change some of the parameters
Start TC is the time to delay before cutting, it gives time for the system to catch up, –200 was the recommend value. Changing this to –400 pretty much cleared up the issue, but also increasing Laser Off TC and Polygon TC to 300 helped as well Polygon TC is the dwell time when it finishes cutting one part of the line in the polygon, Laser off is how long the laser stays on at the end of the cutting operation. Increasing these too much will cause a larger burn area on corners or end of cut so you have to tune it.
Cutting 0.127mm stainless steel our settings currently are
For stencil material it is a little thinner at .011mm and we were able to cut that at Loop 30 , Power 55%
We fiddled with the Frequency(Khz) to get a smooth cut, this changes the amount of power at the cut too and it varies on the waveform, doesn’t just increase with frequency. The lowest setting for our cutter is 20 KHz which makes seperate distinctive dots. 50 KHz was the default and it wasn’t quite as smooth an edge so 75 worked. Q we’re keeping to be as close to a non MOPA fibre as possible.
The effects of the Frequency being too low, reduced power to see the effect
Tried hatching and engraving tests as well, melted, and reformed steel. Commerical stencil cutters are likely a moving head with air assist.
Cross hatch with a run around the edge.
EzCad can be infuriating
One of the annoyances for me is the pen selection, it took me a few tries to figure out if you have anything selected on the work area, you can’t choose a new pen on the right side, so pressing ESC or de-selecting any objects in the workspace fixes that. It takes fovever to setup your default pens, which are stored in the .ezd file too.
Deep Diving
Breaking down the .EZD format
Taking a look at the binary EZD format to see if we can get some insight on how to write custom ones.
First i loaded EzCad and just saved the empty workspace, this generates a 317KBfile. All the pens are in there.
The first thing tried is switching off Default param and resaving, them comparing
Looks good, a 00 to a 01, right side is default param on.
L27320 04 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 08 00 00 00 00 00 00 00 00 40 7F 40 08 00 00 00 …………………….@@….
R27320 04 00 00 00 01 00 00 00 04 00 00 00 01 00 00 00 08 00 00 00 00 00 00 00 00 40 7F 40 08 00 00 00 …………………….@@….
This seems promising, Unicode string, in blocks are there 256 of them?
[C:\ezcad\tests]strings -u default-param-off-empty.ezd >f
Strings v2.53 – Search for ANSI and Unicode strings in binary images.
Copyright (C) 1999-2016 Mark Russinovich
Sysinternals – http://www.sysinternals.com
[C:\ezcad\tests]wc f
f: Words: 257 Lines: 257 Chars: 1800
hmm 257?, a quick peek at the file F tells us why, the first string is EZCADUNI which is part of the header. so yep its 256 pens as expected.
EZCADUNI
Default
Default
Default
There is a header too
Which is followed by a whole bunch of 00 FF FF FF, a
Lets see if the location of the Pens section is fixed, or if it moves around and theres a section pointer or something, i’ll add a rectangle to the file and see what changes.
That causes quite a large change in the file. But its encouraging because what happened was it overwrote some info at the start of the file, some of the ff ff ff 00 changed, the pens seemed to stay in the same place and a whole chunk of stuff was added to the end of the file.
Lets change one of the pen settings now. I set Loop from1 to 2
—————————————————–
L27320 04 00 00 00 00 00 00 00 04 00 00 00 02 00 00 00 08 00 00 00 00 00 00 00 00 40 7F 40 08 00 00 00 …………………….@@….
R27320 04 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 08 00 00 00 00 00 00 00 00 40 7F 40 08 00 00 00 …………………….@@….
Which is in the default section
I’ll add some more shapes to the file and see if the pens move.
Another large change in that first section with the FF FF FF 00 and this time a smaller amount of data, i added a circle at 0,0 and 10mm
Pens didn’t move though. Lets change another parameter in the pen. I changed speed from 500 to 501
—————————————————–
R27320 04 00 00 00 00 00 00 00 04 00 00 00 02 00 00 00 08 00 00 00 00 00 00 00 00 40 7F 40 08 00 00 00 …………………….@@….L27320 04 00 00 00 00 00 00 00 04 00 00 00 02 00 00 00 08 00 00 00 00 00 00 00 00 50 7F 40 08 00 00 00 …………………….P@….
Speed 502
—————————————————–
L27320 04 00 00 00 00 00 00 00 04 00 00 00 02 00 00 00 08 00 00 00 00 00 00 00 00 50 7F 40 08 00 00 00 …………………….P@….
R27320 04 00 00 00 00 00 00 00 04 00 00 00 02 00 00 00 08 00 00 00 00 00 00 00 00 60 7F 40 08 00 00 00 …………………….`@….
Speed 1000, from 502
Changing Power from 100 to 1
—————————————————–
L27340 00 00 00 00 00 00 F0 3F 04 00 00 00 20 4E 00 00 04 00 00 00 04 00 00 00 04 00 00 00 2C 01 00 00 ……ð?…. N…………..,…
R27340 00 00 00 00 00 00 59 40 04 00 00 00 20 4E 00 00 04 00 00 00 04 00 00 00 04 00 00 00 2C 01 00 00 ……Y@…. N…………..,…
So its a mix of ints and doubles.
0x27300 R value byte
0x27301 G value byte
0x27302 G value byte
0x27304 Length of Unicode string int. 4 bytes,
0x27308 Unicode Default 440065006600610075006C0074000000
This moves depending on length of the parameter name, so these are absolute with a unicode string length of 0x10 from base to consider
0x27324 Use default parameter uint8
0x2732c for Loop (range seems 1 to 10,000) 4 bytes int
0x27334 for Speed(MM) its stored as a double 8 bytes.
0x27340 for Power% double
0x2734c for Frequency(Khz) Int32 4 bytes, max 10,000Checking Q but its +4 i think and uint32
0x2735c for Start TC Int32 4 bytes signed
0x273e4 for Laser Off TC(US) uint32 4 bytes, max 10,000
0x27364 for End TC(US) uint32 4 bytes, max 10,000
0x2736C for Polygon TC(US) uint32 4 bytes, max 10,000
Enough to start a simple application to edit these valus, firing up MSVC.
Few hours later !
I’m using default values for testing, so they don’t necessarily make sense yet. Added import and export of CSV so you can edit in text or a spreadsheet, or even share on google sheets etc. has Q since ours is a MOPA.
I found some test grids on web that seem to be an older verison of ezCad and there is an offset difference, which i figured there would be since its such a large offset into the file.
Loading and resaving the EZD in the version of EZCad 2.14.11 i used while testing moved it to the same offset. 0x27300 for mine, 0x464 for the one i found on the web, here’s the header. Since you can load and resave it and it appears at the same offset i’m not super worried but it’d be nice to decode how it knows where it is, assuming there is some relative offset.
EZD writing and CSV Export working
It is feature complete now and i put it on my github for testing, it is very specific to the version of EzCad so i’ve only tested 2.14.11
https://github.com/charlie-x/fibrelasertools
I think i figured out how the pen offset works , offset 0x160 has a uint32_t that gets to the base of the pens – 0x10, tested a few versions of .ezd files and it worked ok, github updated again.
Into the Driver
EzCad2 comes with its own driver board the LMC1/4fiber etc which work over USB and also double a as dongle, which means you can’t use EzCad2 offline as it can’t save. A quick 30 second poke with a hex editor fixed that though just so I could use it on my main PC for testing and it takes FOREVER to build the arrays to test different power and frequency levels
LMC1.dll LMCMIO.dll are the main files for talking to the board, there is an MarkEz.dll available that you can use to interface with the laser, but it is really high level and might be a paid option ?
I converted the header to English.
#ifndef MARKEZDDLL_H
#define MARKEZDDLL_H
// All functions return an integer value
#define LMC1_ERR_SUCCESS 0 // Success
#define LMC1_ERR_EZCADRUN 1 // Found that EZCAD is running
#define LMC1_ERR_NOFINDCFGFILE 2 // Cannot find EZCAD.CFG
#define LMC1_ERR_FAILEDOPEN 3 // Failed to open LMC1
#define LMC1_ERR_NODEVICE 4 // No valid lmc1 device
#define LMC1_ERR_HARDVER 5 // lmc1 version error
#define LMC1_ERR_DEVCFG 6 // Cannot find the device configuration file
#define LMC1_ERR_STOPSIGNAL 7 // Alarm signal
#define LMC1_ERR_USERSTOP 8 // User stops
#define LMC1_ERR_UNKNOW 9 // Unknown error
#define LMC1_ERR_OUTTIME 10 // Timeout
#define LMC1_ERR_NOINITIAL 11 // Not initialized
#define LMC1_ERR_READFILE 12 // Error reading file
#define LMC1_ERR_OWENWNDNULL 13 // The window is empty
#define LMC1_ERR_NOFINDFONT 14 // Cannot find the font with the specified name
#define LMC1_ERR_PENNO 15 // Wrong pen number
#define LMC1_ERR_NOTTEXT 16 // The object with the specified name is not a text object
#define LMC1_ERR_SAVEFILE 17 // Failed to save the file
#define LMC1_ERR_NOFINDENT 18 // The specified object cannot be found
#define LMC1_ERR_STATUE 19 // This operation cannot be performed in the current state
// Initialize the lmc1 control card
// input parameter: strEzCadPath EzCad software execution path
// bTestMode = TRUE means test mode bTestMode = FALSE means normal mode
// pOwenWnd represents the parent window object. If stop marking is required, the system will intercept messages from this window.
typedef int ( *LMC1_INITIAL ) ( wchar_t* strEzCadPath, //ezcad’s working directory
BOOL bTestMode, // Whether it is a test mode
HWND hOwenWnd ); // The parent window
// Close the lmc1 control card
typedef int ( *LMC1_CLOSE ) ();
typedef int ( *LMC1_STOPMARK ) ();
// Load the ezd file and clear all objects in the database
// Input parameters: strFileName EzCad file name
typedef int ( *LMC1_LOADEZDFILE ) ( wchar_t* strFileName );
// Mark all data in the current database
// Input parameters: bFlyMark = TRUE enables flying marking bFlyMark = FALSE enables flying marking
typedef int ( *LMC1_MARK ) ( BOOL bFlyMark );
// Mark the specified object in the current database
// input parameter: strEntName the name of the specified object to be processed
typedef int ( *LMC1_MARKENTITY ) ( wchar_t* strEntName );
// Fly mark the specified object in the current database
// input parameter: strEntName
typedef int ( *LMC1_MARKENTITYFLY ) ( wchar_t* strEntName );
// read the input port of lmc1
// input parameter: data of input port read in
typedef int ( *LMC1_READPORT ) ( WORD& data );
// Write the output port of lmc1
// input parameter: the data of the output port to write to
typedef int ( *LMC1_WRITEPORT ) ( WORD data );
// Get a preview image of all data in the current database
// input parameter: pWnd to which window the preview image is displayed
// nBMPWIDTH preview image width
// nBMPHEIGHT height of preview image
typedef CBitmap* ( *LMC1_GETPREVBITMAP ) ( HWND hwnd, int nBMPWIDTH, int nBMPHEIGHT );
// Call the dialog for setting device parameters
typedef int ( *LMC1_SETDEVCFG ) ();
const int HATCHATTRIB_ALLCALC = 0x01;// All objects are calculated together as a whole
const int HATCHATTRIB_BIDIR = 0x08;// Bidirectional padding
const int HATCHATTRIB_EDGE = 0x02;// Walk once
const int HATCHATTRIB_LOOP = 0x10;// Ring fill
// Set the current filling parameters. If you want to enable filling when adding a new object to the database, this parameter will be used
typedef int ( *LMC1_SETHATCHPARAM ) ( BOOL bEnableContour, // Enable the contour itself
int bEnableHatch1, // Enable fill 1
int nPenNo1, // fill pen
int nHatchAttrib1, // fill attribute
double dHatchEdgeDist1, // fill line margins
double dHatchLineDist1, // fill line spacing
double dHatchStartOffset1, // The starting offset distance of the fill line
double dHatchEndOffset1, // The end offset distance of the fill line
double dHatchAngle1, // fill line angle (radian value)
int bEnableHatch2, // Enable padding 1
int nPenNo2, // fill pen
int nHatchAttrib2, // fill attribute
double dHatchEdgeDist2, // fill line margins
double dHatchLineDist2, // fill line spacing
double dHatchStartOffset2, // The starting offset distance of the fill line
double dHatchEndOffset2, // The end offset distance of the fill line
double dHatchAngle2 ); // fill line angle (radian value)
// Set the current font parameters. If you want to add a new text object to the database, this font parameter will be used.
typedef int ( *LMC1_SETFONTPARAM ) ( wchar_t * strFontName, // font name
double dCharHeight, // character height
double dCharWidth, // character width
double dCharAngle, // character inclination
double dCharSpace, // character spacing
double dLineSpace, // line spacing
BOOL bEqualCharWidth ); // etc. Character width mode
// Get the processing parameters corresponding to the specified pen number
typedef int ( *LMC1_GETPENPARAM ) ( int nPenNo, // the pen number to be set (0-255)
int & nMarkLoop, // processing times
double & dMarkSpeed, // Marking times mm / s
double & dPowerRatio, // power percentage (0-100%)
double & dCurrent, // Current A
int & nFreq, // frequency HZ
int & nQPulseWidth, // Q pulse width us
int & nStartTC, // start delay us
int & nLaserOffTC, // Laser off delay us
int & nEndTC, // end delay us
int & nPolyTC, // corner delay us //
double & dJumpSpeed, // jump speed mm / s
int & nJumpPosTC, // Jump position delay us
int & nJumpDistTC, // Jump distance delay us
double & dEndComp, // end point compensation mm
double & dAccDist, // Acceleration distance mm
double & dPointTime, // dot delay ms
BOOL & bPulsePointMode, // Pulse point mode
int & nPulseNum, // Number of pulse points
double & dFlySpeed );
// Set the processing parameters corresponding to the specified pen number
typedef int ( *LMC1_SETPENPARAM ) ( int nPenNo, // the pen number to be set (0-255)
int nMarkLoop, // processing times
double dMarkSpeed, // Marking times mm / s
double dPowerRatio, // power percentage (0-100%)
double dCurrent, // Current A
int nFreq, // frequency HZ
int nQPulseWidth, // Q pulse width us
int nStartTC, // start delay us
int nLaserOffTC, // Laser off delay us
int nEndTC, // end delay us
int nPolyTC, // corner delay us //
double dJumpSpeed, // jump speed mm / s
int nJumpPosTC, // Jump position delay us
int nJumpDistTC, // jump distance delay us
double dEndComp, // end point compensation mm
double dAccDist, // Acceleration distance mm
double dPointTime, // dot delay ms
BOOL bPulsePointMode, // Pulse point mode
int nPulseNum,
double dFlySpeed ); // Number of pulse points
// Clear all data in the object library
typedef int ( *LMC1_CLEARENTLIB ) ();
// The meaning of the numbers in the alignment
// 6 — 5 — 4
// | |
// | |
// 7 8 3
// | |
// | |
// 0 — 1 — 2
// Add new text to the database
typedef int ( *LMC1_ADDTEXTTOLIB ) ( wchar_t * pStr, // string to add
wchar_t * pEntName, // String object name
double dPosX, // x coordinate of the bottom left corner of the string
double dPosY, // the y-coordinate of the bottom left corner of the string
double dPosZ, // the z coordinate of the string object
int nAlign, // alignment mode 0-8
double dTextRotateAngle, // Angle value (radian value) of the string rotation around the base point
int nPenNo, // processing parameters used by the object
BOOL bHatchText ); // Whether to fill the text object
// Add the specified file to the database
// Supported files are ezd, dxf, dst, plt, ai, bmp, jpg, tga, png, gif, tiff, etc.
typedef int ( *LMC1_ADDFILETOLIB ) ( wchar_t * pFileName, // file name
wchar_t * pEntName, // String object name
double dPosX, // The x coordinate of the base left corner of the file
double dPosY, // y-coordinate of the base point of the bottom left corner of the file
double dPosZ, // z-coordinate of the file
int nAlign, // alignment mode 0-8
double dRatio, // File scaling
int nPenNo, // processing parameters used by the object
BOOL bHatchFile ); // Whether the file object is filled. This parameter is invalid if it is an ezd file or a bitmap file.
// Add the curve to the database
typedef int ( *LMC1_ADDCURVETOLIB ) ( double ptBuf[][2], // curve vertex array
int ptNum, // number of curve vertices
wchar_t * pEntName, // curve object name
int nPenNo, // Pen number used by the curve object
int bHatch ); // whether the curve is filled
#define BARCODETYPE_39 0
#define BARCODETYPE_93 1
#define BARCODETYPE_128A 2
#define BARCODETYPE_128B 3
#define BARCODETYPE_128C 4
#define BARCODETYPE_128OPT 5
#define BARCODETYPE_EAN128A 6
#define BARCODETYPE_EAN128B 7
#define BARCODETYPE_EAN128C 8
#define BARCODETYPE_EAN13 9
#define BARCODETYPE_EAN8 10
#define BARCODETYPE_UPCA 11
#define BARCODETYPE_UPCE 12
#define BARCODETYPE_25 13
#define BARCODETYPE_INTER25 14
#define BARCODETYPE_CODABAR 15
#define BARCODETYPE_PDF417 16
#define BARCODETYPE_DATAMTX 17
#define BARCODETYPE_USERDEF 18
#define BARCODEATTRIB_REVERSE 0x0008 // Barcode reverse
#define BARCODEATTRIB_HUMANREAD 0x1000 // Display human recognition characters
#define BARCODEATTRIB_CHECKNUM 0x0004 // A check code is required
#define BARCODEATTRIB_PDF417_SHORTMODE 0x0040 // PDF417 is shortened mode
#define BARCODEATTRIB_DATAMTX_DOTMODE 0x0080 // DataMtrix is in dot mode
#define BARCODEATTRIB_CIRCLEMODE 0x0100 // Customize QR code to circle mode
#define DATAMTX_SIZEMODE_SMALLEST 0
#define DATAMTX_SIZEMODE_10X10 1
#define DATAMTX_SIZEMODE_12X12 2
#define DATAMTX_SIZEMODE_14X14 3
#define DATAMTX_SIZEMODE_16X16 4
#define DATAMTX_SIZEMODE_18X18 5
#define DATAMTX_SIZEMODE_20X20 6
#define DATAMTX_SIZEMODE_22X22 7
#define DATAMTX_SIZEMODE_24X24 8
#define DATAMTX_SIZEMODE_26X26 9
#define DATAMTX_SIZEMODE_32X32 10
#define DATAMTX_SIZEMODE_36X36 11
#define DATAMTX_SIZEMODE_40X40 12
#define DATAMTX_SIZEMODE_44X44 13
#define DATAMTX_SIZEMODE_48X48 14
#define DATAMTX_SIZEMODE_52X52 15
#define DATAMTX_SIZEMODE_64X64 16
#define DATAMTX_SIZEMODE_72X72 17
#define DATAMTX_SIZEMODE_80X80 18
#define DATAMTX_SIZEMODE_88X88 19
#define DATAMTX_SIZEMODE_96X96 20
#define DATAMTX_SIZEMODE_104X104 21
#define DATAMTX_SIZEMODE_120X120 22
#define DATAMTX_SIZEMODE_132X132 23
#define DATAMTX_SIZEMODE_144X144 24
#define DATAMTX_SIZEMODE_8X18 25
#define DATAMTX_SIZEMODE_8X32 26
#define DATAMTX_SIZEMODE_12X26 27
#define DATAMTX_SIZEMODE_12X36 28
#define DATAMTX_SIZEMODE_16X36 29
#define DATAMTX_SIZEMODE_16X48 30
// Add barcode to database
typedef int ( *LMC1_ADDBARCODETOLIB ) ( wchar_t * pStr, // string
wchar_t * pEntName, // String object name
double dPosX, // The x coordinate of the base left corner of the character
double dPosY, // Y-coordinate of the base left corner of the character
double dPosZ, // character z coordinate
int nAlign, // alignment mode 0-8
int nPenNo,
int bHatchText,
int nBarcodeType, // Barcode type
WORD wBarCodeAttrib, // Barcode attribute
double dHeight, // the height of the entire barcode
double dNarrowWidth, // the narrowest module width
double dBarWidthScale[4], // bar width ratio (compared to the narrowest module width)
double dSpaceWidthScale[4], // space width ratio (compared to the narrowest module width)
double dMidCharSpaceScale, // character space ratio (compared to the narrowest module width)
double dQuietLeftScale, // the left margin width ratio of the barcode (compared to the narrowest module width)
double dQuietMidScale, // ratio of blank width in barcode (compared to the narrowest module width)
double dQuietRightScale, // the right margin width ratio of the barcode (compared to the narrowest module width)
double dQuietTopScale, // ratio of blank width on barcode (compared to the narrowest module width)
double dQuietBottomScale, // ratio of blank width under barcode (compared to the narrowest module width)
int nRow, // Number of QR code lines
int nCol, // Number of QR code columns
int nSizeMode, // DataMatrix size mode 0-30
double dTextHeight, // Font height
double dTextWidth, // Font width
double dTextOffsetX, // X direction offset of human recognition characters
double dTextOffsetY, // Y-direction offset of human recognition characters
double dTextSpace, // Person recognition character spacing
double dDiameter,
wchar_t * pTextFontName ); // Text font name
// Change the text of the specified text object in the current database
// input parameter: strTextName the name of the text object whose content you want to change
// strTextNew new text content
typedef int ( *LMC1_CHANGETEXTBYNAME ) ( wchar_t * strTextName, wchar_t * strTextNew );
// Set the rotation transformation parameters
// Input parameters: dCenterX x coordinate of rotation center
// dCenterY y coordinate of rotation center
// dRotateAng rotation angle (radian value)
typedef void ( *LMC1_SETROTATEPARAM ) ( double dCenterX, double dCenterY, double dRotateAng );
//////////////////////////////////////// /////////////// //////////////////
// Extended axis function
// The extension axis moves to the specified coordinate position
// input parameter: axis extended axis 0 = axis 0 1 = axis 1
// GoalPos coordinate position
typedef int ( *LMC1_AXISMOVETO ) ( int axis, double GoalPos );
// Expansion axis correction origin
// input parameter: axis extended axis 0 = axis 0 1 = axis 1
typedef int ( *LMC1_AXISCORRECTORIGIN ) ( int axis );
// Get the current coordinates of the extended axis
// input parameter: axis extended axis 0 = axis 0 1 = axis 1
typedef double ( *LMC1_GETAXISCOOR ) ( int axis );
// The extension axis moves to the specified pulse coordinate position
// input parameter: axis extended axis 0 = axis 0 1 = axis 1
// nGoalPos pulse coordinate position
typedef int ( *LMC1_AXISMOVETOPULSE ) ( int axis, int nGoalPos );
// Get the current pulse coordinates of the extended axis
// input parameter: axis extended axis 0 = axis 0 1 = axis 1
typedef int ( *LMC1_GETAXISCOORPULSE ) ( int axis );
// Reset extended axis coordinates
// Input parameters: bEnAxis0 = enable axis 0 bEnAxis1 = enable axis 1
typedef double ( *LMC1_RESET ) ( BOOL bEnAxis0, BOOL bEnAxis1 );
// Font type attribute definition
#define FONTATB_JSF 0x0001 // JczSingle font
#define FONTATB_TTF 0x0002 // TrueType font
#define FONTATB_DMF 0x0004 // DotMatrix font
#define FONTATB_BCF 0x0008 // BarCode font
// Font record
struct lmc1_FontRecord {
wchar_t szFontName[256]; // font name
DWORD dwFontAttrib; // font attribute
};
// Get all font parameters supported by the current system
// Input parameters: None
// Output parameter: nFontNum font number
// Return parameter: lmc1_FontRecord * array of font records
typedef lmc1_FontRecord * ( *LMC1_GETALLFONTRECORD ) ( int & nFontNum );
// Save all objects in the current database to the specified ezd file
// Input parameters: strFileName ezd file name
typedef int ( *LMC1_SAVEENTLIBTOFILE ) ( wchar_t * strFileName );
// Get the maximum and minimum coordinates of the specified object.
typedef int ( *LMC1_GETENTSIZE ) ( wchar_t * pEntName, // String object name
double & dMinx,
double & dMiny,
double & dMaxx,
double & dMaxy,
double & dZ );
// Move the relative coordinates of the specified object
typedef int ( *LMC1_MOVEENT ) ( wchar_t * pEntName, // String object name
double dMovex,
double dMovey );
// Scale the specified object, zoom center coordinates (dCenx, dCeny)
typedef int ( *LMC1_SCALEENT ) ( wchar_t * pEntName, // String object name
double dCenx,
double dCeny,
double dScaleX,
double dScaleY );
// Mirror specified object, mirror center coordinates (dCenx, dCeny) bMirrorX = TRUE X direction mirror bMirrorY = TRUE Y direction
typedef int ( *LMC1_MIRRORENT ) ( wchar_t * pEntName, // String object name
double dCenx,
double dCeny,
BOOL bMirrorX,
BOOL bMirrorY );
// Rotate the specified object, and rotate the center coordinates (dCenx, dCeny)
typedef int ( *LMC1_ROTATEENT ) ( wchar_t * pEntName, // String object name
double dCenx,
double dCeny,
double dAngle );
// Rotate the specified object, the coordinates of the rotation center (dCenx, dCeny) dAngle = rotation angle (positive counterclockwise, the unit is degree)
typedef int ( *LMC1_SETROTATEMOVEPARAM ) ( double dMoveX, // X displacement distance
double dMoveY, // Y displacement distance
double dCenterX, // X-coordinate of rotation center
double dCenterY, // Y-coordinate of rotation center
double dAngle ); // rotation angle
typedef int ( *LMC1_REDLIGHTMARK ) (); // Mark the red light frame
typedef int ( *LMC1_MARKLINE ) ( double x1,
double y1,
double x2,
double y2,
int pen ); //
typedef int ( *LMC1_MAKEPOINT ) ( double x,
double y,
double delay,
int pen ); //
// Get the total number of objects
// output parameter: total number of objects
typedef int ( *LMC1_GETENTITYCOUNT ) ();
// Get the name of the object with the specified sequence number
// Input parameters: nEntityIndex The number of the specified object (circle: 0-(lmc1_GetEntityCount ()-1))
// output parameter: name of szEntName object
typedef int ( *LMC1_GETENTITYNAME ) ( int nEntityIndex, wchar_t szEntName[256] );
// Get the dog’s customer ID number
typedef WORD ( *LMC1_GETCLIENTID ) ();
typedef int ( *LMC1_GETCURCOOR ) ( double & x,
double & y ); //
typedef int ( *LMC1_GOTOPOS ) ( double x, double y );
// Get the text of the specified object
typedef int ( *LMC1_GETTEXTBYNAME ) ( wchar_t * strTextName, wchar_t strText[256] );
#endif
It’s a good start but it is very tied to the version of EzCad we’re trying to see what the cost of the SDK is, it also seems like the LMC board has a lockout for the SDK mode that has to be unlocked by the EzCad folks, so a bit of a dead end.
Using the DLL is the usual LoadLibrary with GetProcAddress setup.
m_lmc1_LoadEzdFile ( ( LPTSTR ) ( “test.ezd”) );
etc…. Well it’d be nice to get yet more control.
Next lets look at the LMCMIO.dll, after extracting the exports with dumpbin /exports and and then undec to demangle the c++ names.
#ifndef _LMCMIO_H_
#define _LMCMIO_H_ (1)// charliex
#define API __cdecl#define tagR struct tagResult
tagR API MIO_AxisGoOrigin(unsigned char device,unsigned short,int,class CWnd *cWnd);
void API MIO_Close(int);
void API MIO_Close(void);tagR API MIO_Cmd(unsigned char device,unsigned short,unsigned short,unsigned short,unsigned short,unsigned short,unsigned short);
tagR API MIO_DisableLaser(unsigned char device);
tagR API MIO_ENABLEZ(unsigned char device,int);int API MIO_EarseEpprom(unsigned char device);
int API MIO_EleExecute(unsigned char device,char *,void *,unsigned long,void *,unsigned long,unsigned long &);tagR API MIO_EnableLaser(unsigned char device);
int API MIO_EppromGetMark(unsigned char device,unsigned char * const);
int API MIO_EppromSetMark(unsigned char device,unsigned char * const);
int API MIO_EppromSetTimeStamp(unsigned char device);tagR API MIO_ExecuteList(unsigned char device);
tagR API MIO_GetAxisPos(unsigned char device,unsigned short);
struct _GUID API MIO_GetClassGUID(void);void * API MIO_GetDevHandle(int);
tagR API MIO_GetFlyWaitCount(unsigned char device,int,long &);
tagR API MIO_GetListStatus(unsigned char device);
tagR API MIO_GetLmcInfo(unsigned short * const);int API MIO_GetLmcPartNo(unsigned char device,unsigned short &,unsigned short &);
tagR API MIO_GetMarkCount(unsigned char device,int,long &);
tagR API MIO_GetPositionXY(unsigned char device);
tagR API MIO_GetSerialNo(unsigned char device);
tagR API MIO_GetState(unsigned char device);
tagR API MIO_GetVersion(unsigned char device,unsigned short);
tagR API MIO_GotoXY(unsigned char device,unsigned short x,unsigned short y);
tagR API MIO_IPG_GetStMO_AP(unsigned char device);
tagR API MIO_IPG_OpenMO(unsigned char device,int);
tagR API MIO_LaserSignalOff(unsigned char device);
tagR API MIO_LaserSignalOn(unsigned char device);int API MIO_ModifyEpprom(unsigned char device);
tagR API MIO_MoveAxisTo(unsigned char device,unsigned short,unsigned long,class CWnd *cwnd);
tagR API MIO_NewCmd(unsigned char device,unsigned short *,unsigned long);int API MIO_NxpGetDevelopNum(unsigned char device,void *,unsigned long);
int API MIO_Open(int);
int API MIO_OpenNewDev(void);
int API MIO_ReadAllEpprom(unsigned char device,void *,unsigned long);
int API MIO_ReadEpprom(unsigned char device,void *,unsigned long);
int API MIO_ReadNxp(unsigned char device,void *,unsigned long);tagR API MIO_ReadPort(unsigned char device);
tagR API MIO_Reset(unsigned char device);
tagR API MIO_ResetList(unsigned char device);
tagR API MIO_RestartList(unsigned char device);
tagR API MIO_SETZDATA(unsigned char device,unsigned char,unsigned char,unsigned short);
tagR API MIO_SetAxisMotionParam(unsigned char device,unsigned short,unsigned short);
tagR API MIO_SetAxisOriginParam(unsigned char device,unsigned short,unsigned short);
tagR API MIO_SetControlMode(unsigned char device,unsigned short);
tagR API MIO_SetDelayMode(unsigned char device,unsigned short);
tagR API MIO_SetEndOfList(unsigned char device);
tagR API MIO_SetFirstPulseKiller(unsigned char device,unsigned short);
tagR API MIO_SetFlyRes(unsigned char device,unsigned short,unsigned short,unsigned short,unsigned short,unsigned short);
tagR API MIO_SetFpkParam2(unsigned char device,unsigned short,unsigned short,unsigned short,unsigned short);
tagR API MIO_SetFpkParam(unsigned char device,unsigned short,unsigned short,unsigned short,unsigned short);
tagR API MIO_SetLaserMode(unsigned char device,unsigned short);int API MIO_SetLmcPartNo(unsigned char device,unsigned short,unsigned short);
tagR API MIO_SetMaxPolyDelay(unsigned char device,unsigned short);
tagR API MIO_SetPwmHalfPeriod(unsigned char device,unsigned short);
tagR API MIO_SetPwmPulseWidth(unsigned char device,unsigned short);
tagR API MIO_SetSPISimmerCurrent(unsigned char device,unsigned short,int);
tagR API MIO_SetStandby(unsigned char device,unsigned short,unsigned short,int);int API MIO_SetSysParam(unsigned char device,unsigned char *,unsigned int,unsigned char *,unsigned int);
tagR API MIO_SetTiming(unsigned char device,unsigned short);
tagR API MIO_StopExecute(unsigned char device);
tagR API MIO_StopList(unsigned char device);
tagR API MIO_TransferDataZ(unsigned char device,unsigned short *,unsigned long);
tagR API MIO_Verify(unsigned char device);
tagR API MIO_WriteAnalogPort1(unsigned char device,unsigned short);
tagR API MIO_WriteAnalogPort2(unsigned char device,unsigned short);
tagR API MIO_WriteAnalogPortX(unsigned char device,unsigned short,unsigned short);
tagR API MIO_WriteCmdBuf(unsigned char device,struct tagLmcCmd *);
tagR API MIO_WriteCorTable(unsigned char device,int,unsigned short (* const);[65][2]);int API MIO_WriteEpprom(unsigned char device,void *,unsigned long);
int API MIO_WriteNxp(unsigned char device,void *,unsigned long);tagR API MIO_WritePort(unsigned char device,unsigned short,unsigned short);
#endif
Lots of interesting stuff there, C++ and C, this looks like the last interface to the LMC1 board, there is also the LMC1.dll
Processing it in the same way , we see this.
public: __thiscall CLaserParamExtOutput::CLaserParamExtOutput(void) public: __thiscall CLmcDev::CLmcDev(class CLmcDev const &) public: __thiscall CLmcDev::CLmcDev(void) public: __thiscall CQComByte::CQComByte(class CQComByte const &) public: __thiscall CQComByte::CQComByte(void) public: __thiscall CLaserParamExtOutput::~CLaserParamExtOutput(void) public: __thiscall CLmcDev::~CLmcDev(void) public: virtual __thiscall CQComByte::~CQComByte(void) public: class CLaserParamExtOutput & __thiscall CLaserParamExtOutput::operator=(class CLaserParamExtOutput const &) public: class CLmcDev & __thiscall CLmcDev::operator=(class CLmcDev const &) public: class CQComByte & __thiscall CQComByte::operator=(class CQComByte const &) const CLmcDev::`vftable' const CQComByte::`vftable' public: int __thiscall CLmcDev::AddCmd(unsigned short,unsigned short,unsigned short,unsigned short,unsigned short,unsigned short) public: void __thiscall CQComByte::Answer(unsigned char *,int) public: int __thiscall CLmcDev::AppendNullCmd(void) public: int __thiscall CLmcDev::AppendNullCmdAndRun(void) public: int __thiscall CQComByte::Ask(unsigned char *,unsigned long,int) public: int __thiscall CQComByte::AskAnswerStop(unsigned char *,unsigned long,unsigned char) public: int __thiscall CQComByte::AskStr(class CString,int) public: int __thiscall CLmcDev::AxisGotoOrigin(int,int) public: int __thiscall CLmcDev::AxisMoveTo(int,double,int,int) public: int __thiscall CLmcDev::AxisMoveToDlg(int,double,int,int) public: int __thiscall CLmcDev::AxisMoveToGoal(int,int,int,int) public: double __thiscall CLmcDev::CalcJumpTime(double,unsigned short &) public: int __thiscall CLmcDev::ChangeEnt(class CEntity *) public: int __thiscall CLmcDev::CheckDevelopNumber(void) public: int __thiscall CLmcDev::CheckLaserState(int) public: void __thiscall CLaserParamExtOutput::Clear(void) public: void __thiscall CLmcDev::ClearLockInputPort(void) public: int __thiscall CLmcDev::Co2QuickPulseModeLine(class CArray<class Pt2d,class Pt2d &> &,int,double,double) public: int __thiscall CQComByte::Connect(void) protected: void __thiscall CLmcDev::D2P(int const &,double const &,unsigned short &)const public: void __thiscall CLmcDev::D2P(double const &,double const &,unsigned short &,unsigned short &)const public: int __thiscall CLmcDev::D2P_X(double const &)const public: int __thiscall CLmcDev::D2P_Y(double const &)const public: void __thiscall CQComByte::Destroy(void) public: void __thiscall CLmcDev::DestroyExcelCor(void) public: void __thiscall CQComByte::DisConnect(void) public: int __thiscall CLmcDev::EleExecute(char *,void *,unsigned long,void *,unsigned long,unsigned long &) public: void __thiscall CQComByte::EmptyAnswerBuf(void) public: void __thiscall CLmcDev::EnableLockInputPort(int) public: void __thiscall CLmcDev::ExcelCor(double &,double &) public: int __thiscall CLmcDev::ExeCurCmd(int) public: int __thiscall CLmcDev::ExecMarkCmdFile(int) public: int __thiscall CLmcDev::ExtAxisGetCurPos(int) public: int __thiscall CLmcDev::ExtAxisGotoOrigin(int) public: int __thiscall CLmcDev::ExtAxisMoveToPos(int,int,double,double,double) public: virtual int __thiscall CLmcDev::FinishMark(void) public: void __thiscall CQComByte::GetAnswer(unsigned char *,int,int &) public: int __thiscall CLmcDev::GetAxisCoorInt(int const &) public: class CString __thiscall CLmcDev::GetBoardHardInfoString(void) public: int __thiscall CLmcDev::GetCardNo(void)const public: int __thiscall CLmcDev::GetCardSN(void)const public: int __thiscall CLmcDev::GetCardState(unsigned short &) public: double __thiscall CLmcDev::GetCoor(int const &) public: int __thiscall CLmcDev::GetCurCmdNum(void) public: unsigned short __thiscall CLmcDev::GetCurOutPortData(void) public: int __thiscall CLmcDev::GetCurPosition(double &,double &) public: unsigned short __thiscall CLmcDev::GetDevState(void) protected: double __thiscall CLmcDev::GetDistMap(int const &,unsigned short const &)const public: class Pt2d __thiscall CLmcDev::GetExcelCorPt(class Pt2d) public: int __thiscall CLmcDev::GetFiberStateCode(void) public: void __thiscall CLmcDev::GetFieldOffset(double &,double &) public: int __thiscall CLmcDev::GetFlyPulseCount55(int,unsigned short &) public: int __thiscall CLmcDev::GetFlySpeed(double,double &) public: int __thiscall CLmcDev::GetFlyWaitCount(int,int &) public: int __thiscall CLmcDev::GetHardwareVer(unsigned short &,unsigned short &) public: int __thiscall CLmcDev::GetIOBoardType(void) public: int __thiscall CLmcDev::GetLaserStateErrCode(void) public: int __thiscall CLmcDev::GetLmcBoardNo(unsigned short &,unsigned short &) public: int __thiscall CLmcDev::GetLockInputPort(unsigned short &) public: int __thiscall CLmcDev::GetMarkCount(int,int &) public: int __thiscall CLmcDev::GetMarkTime(int &,int &,int &,int &) public: double __thiscall CLmcDev::GetMaxCurrent(void) public: double __thiscall CLmcDev::GetMaxPowerRatio(void) protected: unsigned short __thiscall CLmcDev::GetPluseMap(int const &,double const &)const public: double __thiscall CLmcDev::GetRealMap(double,double,double * const) public: int __thiscall CLmcDev::GetState(unsigned short &) public: unsigned short __thiscall CLmcDev::GetStopSignal(void) public: int __thiscall CLmcDev::GetUserData(unsigned short &,unsigned short &) public: int __thiscall CLmcDev::Goto(double,double) protected: int __thiscall CLmcDev::GotoOriginKernal(int,int) public: int __thiscall CLmcDev::IPGGetConfigExtend(int,unsigned short &,unsigned short &) public: int __thiscall CLmcDev::IPGGetPrepump(int &) public: int __thiscall CLmcDev::IPGGetPulseWidth(int &) public: int __thiscall CLmcDev::IPGGetPulseWidthMaxIndex(int &) public: int __thiscall CLmcDev::IPGGetPulseWidthPs(int &) public: int __thiscall CLmcDev::IPGSetConfigExtend(int,int) public: int __thiscall CLmcDev::IPGSetPrepump(int) public: int __thiscall CLmcDev::IPGSetPulseWidth(int) public: int __thiscall CLmcDev::IPGSetPulseWidthIndex(int) public: int __thiscall CLmcDev::IPGSetPulseWidthPs(int) public: void __thiscall CLmcDev::IPG_CloseMO(void) public: int __thiscall CLmcDev::IPG_GetStateMO_AP(unsigned short &) public: void __thiscall CLmcDev::IPG_OpenMO(void) public: int __thiscall CLmcDev::InitCfgExcelCor(struct LmcCfg *) public: int __thiscall CLmcDev::InitGetBoardHardInfo(void) public: int __thiscall CLmcDev::InitLmc(int,int) public: int __thiscall CLmcDev::InitZData(double *,unsigned long *,int,unsigned long,int) public: int __thiscall CLmcDev::InitZDataEx(double *,unsigned long *,int,int) public: int __thiscall CQComByte::IsAnswered(void) public: int __thiscall CLmcDev::IsAxisGoHome(int) public: int __thiscall CLmcDev::IsAxisInOrigin(int) public: int __thiscall CLmcDev::IsBoardSupportFun(int) public: int __thiscall CQComByte::IsConnect(void) public: int __thiscall CLmcDev::IsEntWillChange(class CEntity *) public: virtual int __thiscall CLmcDev::IsEsc(void) public: int __thiscall CLmcDev::IsExtAxisInOrigin(int,int) public: int __thiscall CLmcDev::IsMustDestroyDog(void) public: void __thiscall CLmcDev::IsSleepTimeCloseLaser(void) public: int __thiscall CLmcDev::IsStartExeList(void) public: int __thiscall CLmcDev::IsValidDev(void) public: int __thiscall CLmcDev::LaserLeakHandle(int) public: void __thiscall CLmcDev::LaserSignalOn(int) public: int __thiscall CLmcDev::MM2P(int const &,double const &)const public: int __thiscall CLmcDev::MarkBarcodePointMode(class CEntity *,int,double,double,class CMatrix2d *) public: int __thiscall CLmcDev::MarkEnt(class CEntity *,int,double,double,class CMatrix2d *) public: int __thiscall CLmcDev::MarkEntArray(class CEntity *,int,double,double,class CMatrix2d *) public: int __thiscall CLmcDev::MarkLineArray(class CArray<class Pt2d,class Pt2d &> &,double,double) public: int __thiscall CLmcDev::MarkWobble(class CArray<class Pt2d,class Pt2d &> &,double,double,double,double) public: int __thiscall CLmcDev::NewCmd(unsigned short *,int,unsigned short &,unsigned short &) public: struct tagResult __thiscall CLmcDev::New_MIO_AxisGoOrigin(unsigned char,unsigned short,int,class CWnd *) public: struct tagResult __thiscall CLmcDev::New_MIO_MoveAxisTo(unsigned char,unsigned short,unsigned long,class CWnd *) protected: void __thiscall CLmcDev::P2D(int const &,unsigned short const &,double &)const public: void __thiscall CLmcDev::P2D(unsigned short const &,unsigned short const &,double &,double &)const public: double __thiscall CLmcDev::P2D_X(int const &)const public: double __thiscall CLmcDev::P2D_Y(int const &)const public: double __thiscall CLmcDev::P2MM(int const &,int const &)const public: int __thiscall CLmcDev::QS_Digtal_Output(unsigned short,unsigned short) public: int __thiscall CQComByte::ReadCommBlock(unsigned char *,int) public: int __thiscall CLmcDev::ReadCorFile(class CString) public: int __thiscall CLmcDev::ReadPort(unsigned short &) public: virtual int __thiscall CLmcDev::ReadyMark(int) public: int __thiscall CLmcDev::Reset(void) public: virtual int __thiscall CLmcDev::Run(void) public: void __thiscall CLmcDev::SPI_CloseGlobal(void) public: void __thiscall CLmcDev::SPI_OpenGlobal(void) public: void __thiscall CLmcDev::SPI_SetWave(void) public: virtual int __thiscall CLmcDev::ScanBmp(class CEntity *,double,double,class CMatrix2d *) public: int __thiscall CLmcDev::ScanBmpPtBuf(struct BmpScanPt *,int,int,double,double,double) public: int __thiscall CLmcDev::SetAnalog2(unsigned short) public: int __thiscall CLmcDev::SetAxisAccTime(int) public: void __thiscall CLmcDev::SetBoardSNStr(class CString) public: void __thiscall CLmcDev::SetCardNo(int,int) public: int __thiscall CLmcDev::SetCo2FPK(int,double,double) public: int __thiscall CLmcDev::SetCurrent(double) public: void __thiscall CLmcDev::SetDevState(unsigned short,int) public: int __thiscall CLmcDev::SetDisableZ(void) public: int __thiscall CLmcDev::SetEnableZ(void) public: int __thiscall CLmcDev::SetFPK(int,int,double,double,int,int) public: int __thiscall CLmcDev::SetFlyRes(int,double,int,int,double,int,int) public: int __thiscall CLmcDev::SetFreqAnalogOutput(int) public: void __thiscall CLmcDev::SetJumpDelayTC(double,double) public: void __thiscall CLmcDev::SetMaxCurrent(double) public: void __thiscall CLmcDev::SetMaxPowerRatio(double) public: void __thiscall CLmcDev::SetOwen(class CWnd *) public: int __thiscall CLmcDev::SetPowerAnalogOutput(double) public: int __thiscall CLmcDev::SetSPISimmerCurrent(double) public: int __thiscall CLmcDev::SetZData(unsigned char,unsigned char,unsigned short) public: void __thiscall CLmcDev::ShowMarkInfo(class CString) public: int __thiscall CLmcDev::StandardMarkLine(class CArray<class Pt2d,class Pt2d &> &,int,double,double,int) public: int __thiscall CLmcDev::StopExecute(void) public: void __thiscall CLmcDev::UpdateCurAxisCoor(int) public: int __thiscall CLmcDev::VarTextElementConnectHostGetAnwser(class CEntSuperText *) public: int __thiscall CQComByte::WaitForAnswer(void) public: int __thiscall CLmcDev::WaitForFinish(void) public: int __thiscall CLmcDev::WaitForMarkFinish(void) public: int __thiscall CLmcDev::WeldLine(class CArray<class Pt2d,class Pt2d &> &,int,double,double) public: int __thiscall CLmcDev::WeldPoint(class CArray<class Pt2d,class Pt2d &> &,int,double,double) public: int __thiscall CQComByte::WriteCommBlock(unsigned char *,unsigned long) public: int __thiscall CLmcDev::WritePort(unsigned short) int __cdecl ctrlGetRaycusState(class CLmcDev *,unsigned short &,int &,int &) int __cdecl ctrlRaycusSetParam(class CLmcDev *,int,int,int) void __cdecl gf_CloseUsbMonitor(void) int __cdecl gf_DlgInputPassword(class CString &) int __cdecl gf_DlgSetCfg(int,class CLmcDev *,struct LmcCfg &,class CWnd *) class CString __cdecl gf_GetLmcCfgPath(void) class CLmcDev * __cdecl gf_GetLmcDev(void) struct tagResult __cdecl gf_GetLmcDevState(class CLmcDev *) void __cdecl gf_InitLmcCfg(struct LmcCfg &) int __cdecl gf_InitUsbMonitor(class CWnd *) int __cdecl gf_ReadLmcCfg(struct LmcCfg &,class CString) void __cdecl gf_RestartMark(void) int __cdecl gf_SaveLmcCfg(struct LmcCfg &,class CString) void __cdecl gf_SetLmcCfgPath(class CString) class CLmcDev * __cdecl gf_SetLmcDev(class CLmcDev *) void __cdecl gf_SetPauseFlag(int) int __cdecl gf_StartMarkDlg(class CString,class CString) int __cdecl gf_UsbMonitorGetNewDevice(void) public: int __thiscall CLmcDev::listChangeMarkCount(int) public: int __thiscall CLmcDev::listDelayTime(int) public: int __thiscall CLmcDev::listDelayTimeUs(int) public: int __thiscall CLmcDev::listDirectLaserSwitch(int) public: int __thiscall CLmcDev::listDirectMarkTo(double,double) public: int __thiscall CLmcDev::listEnableWeldPowerWave(int) public: int __thiscall CLmcDev::listEndOfList(void) public: int __thiscall CLmcDev::listFlyDelay(int) public: int __thiscall CLmcDev::listFlyEnable(int) public: int __thiscall CLmcDev::listFlyEncoderCount(int,int,int,int,int) public: int __thiscall CLmcDev::listIPGOpenMO(int) public: int __thiscall CLmcDev::listIPGPulseWidthIndex(int) public: int __thiscall CLmcDev::listIPGSetConfigExtend(int,int) public: int __thiscall CLmcDev::listIPGSetPrepump(int) public: int __thiscall CLmcDev::listIPGYLPMPulseWidth(int) public: int __thiscall CLmcDev::listIPGYLPMPulseWidthPs(int) public: int __thiscall CLmcDev::listJptSetParam(double,int,double) public: int __thiscall CLmcDev::listJumpSpeed(double) public: int __thiscall CLmcDev::listJumpTo(double,double,int) public: int __thiscall CLmcDev::listLaserExtOutput(int) public: int __thiscall CLmcDev::listLaserOffDelay(int) public: int __thiscall CLmcDev::listLaserOnDelay(int) public: int __thiscall CLmcDev::listLaserOnPoint(double) public: int __thiscall CLmcDev::listMarkCurrent(double) public: int __thiscall CLmcDev::listMarkEndDelay(int) public: int __thiscall CLmcDev::listMarkFreq(int) public: int __thiscall CLmcDev::listMarkPowerRatio(double) public: int __thiscall CLmcDev::listMarkPulseWidth(double) public: int __thiscall CLmcDev::listMarkSpeed(double) public: int __thiscall CLmcDev::listMarkTo(double,double,int) public: int __thiscall CLmcDev::listPolygonDelay(int) public: int __thiscall CLmcDev::listSetAnalogFPK(int,int,double,double,int,int) public: int __thiscall CLmcDev::listSetDaZ(double) public: int __thiscall CLmcDev::listSetDaZWord(unsigned short) public: int __thiscall CLmcDev::listSetMarkParam(struct MarkParam &) public: int __thiscall CLmcDev::listSetWeldPowerWave(int,unsigned short * const,unsigned short * const) public: int __thiscall CLmcDev::listWaitForInput(unsigned short,unsigned short) public: int __thiscall CLmcDev::listWritrPort(unsigned short) void __cdecl lmc_CloseDriver(void) int __cdecl lmc_GetValidDev(class CLmcDev * * const,int &) int __cdecl lmc_OpenDriver(int) public: int __thiscall CLmcDev::lsFlyWaitInput(int,int,int)
Yep, as figured this is a higher level C++ API to talk to LMCMIO.dll etc.
These are all 32 bit windows AFX/MFC dlls, you can tell via the CBitmap/CWnd etc
Some of the basic C funcs are just wrappers that call the MIO, like lmc_OpenDriver is a stub for MIO_Open, there is also a sprinkling of gf_ calls which seems mostly related to setup and configs as well as some utility functions.
DataMgr.dll is the other interesting DLL, that one is heavily tied to EzCad, checking the LMC board and so on. more of the gf_ and AFX/MFC there interfaces to the barcode generation, Excel and huffman encoding in there too, so it does a lot of the heavy lifting for EzCad.
We’re trying to get the seller (Who has been very helpful so far) to work with us on the cutting issue for the stencils, unfortunately we have to get through all the basic troubleshooting and setup issues that most users will go thru (we did too) but i sent them an example EZD file that shows the issue, so hopefully they can cut it and test it, unfortunately New Year and Corona Virus since they’re in Wuhan….
So not a terrific amount of useful info so far, I was able to write a quick test app to init the system and see about the incompatibilities with the DLLs and different versions of EzCad , it being a heavily C++ system there are a lot of ABI changes so anytime a vtable, or such changes it’ll break. It’s a lot easier to patch around this for pure C import DLLs.
Turning the file save on for EzCad to allow using it without being connected to the Laser, is useful too.
How to unmangle decorated names
This uses the undocumented unDNameEx function to demangle C++ names from msvc, its what the undname.exe uses, which you can just do a dumpbin /exports and feed the results into as well. First it scans the dll for the exports, then it demangles them. unDNameEx can cause memory issues if not used properly.
// demangler.cpp : This file contains the ‘main’ function. Program execution begins and ends there.
//
#include <windows.h>
#include <Dbghelp.h>
#pragma comment(lib,"dbghelp.lib")
#include <iostream>
#include <string>#include <vector>
extern "C" PSTR __cdecl __unDNameEx(
PSTR output_buffer,PCSTR mangled_name,
DWORD cb,
void* (__cdecl* memory_et)(DWORD),
void(__cdecl* memory_free)(void*),
PSTR(__cdecl* unk_GetParameter)(long i),
DWORD un_flags
);
static const DWORD un_dwFlags = UNDNAME_COMPLETE;
static void* __cdecl _dAlloc(ULONG cb)
{return new (std::nothrow) char[cb];
}
static void __cdecl _dFree(void* p)
{if (p) {
delete[] p;
}
}
static PSTR __cdecl _dGetParameter(long ignore)
{static char none[] = "";
return none;
}
bool GetDLLFileExports(const char *szFileName, std::vector<std::string>&pszFunctions)
{HANDLE hFile;
HANDLE hFileMapping;
LPVOID lpFileBase;
PIMAGE_DOS_HEADER pImg_DOS_Header;
PIMAGE_NT_HEADERS pImg_NT_Header;
PIMAGE_EXPORT_DIRECTORY pImg_Export_Dir;
hFile = CreateFile(szFileName, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
if (hFile == INVALID_HANDLE_VALUE) {
return false;}
hFileMapping = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
if (hFileMapping == 0) {
CloseHandle(hFile);return false;
}
lpFileBase = MapViewOfFile(hFileMapping, FILE_MAP_READ, 0, 0, 0);
if (lpFileBase == 0) {
CloseHandle(hFileMapping);CloseHandle(hFile);
return false;
}
pImg_DOS_Header = (PIMAGE_DOS_HEADER)lpFileBase;
pImg_NT_Header = (PIMAGE_NT_HEADERS)((LONG)pImg_DOS_Header + (LONG)pImg_DOS_Header->e_lfanew);
if (IsBadReadPtr(pImg_NT_Header, sizeof(IMAGE_NT_HEADERS)) || pImg_NT_Header->Signature != IMAGE_NT_SIGNATURE) {
UnmapViewOfFile(lpFileBase);CloseHandle(hFileMapping);
CloseHandle(hFile);
return false;
}
pImg_Export_Dir = (PIMAGE_EXPORT_DIRECTORY)pImg_NT_Header->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
if (!pImg_Export_Dir) {
UnmapViewOfFile(lpFileBase);CloseHandle(hFileMapping);
CloseHandle(hFile);
return false;
}
pImg_Export_Dir = (PIMAGE_EXPORT_DIRECTORY)ImageRvaToVa(pImg_NT_Header, pImg_DOS_Header, (DWORD)pImg_Export_Dir, 0);
DWORD **ppdwNames = (DWORD **)pImg_Export_Dir->AddressOfNames;
ppdwNames = (PDWORD*)ImageRvaToVa(pImg_NT_Header, pImg_DOS_Header, (DWORD)ppdwNames, 0);
if (!ppdwNames) {
UnmapViewOfFile(lpFileBase);CloseHandle(hFileMapping);
CloseHandle(hFile);
return false;
}
unsigned int nNoOfExports = pImg_Export_Dir->NumberOfNames;
for (unsigned i = 0; i < nNoOfExports; i++) {
char *szFunc = (PSTR)ImageRvaToVa(pImg_NT_Header, pImg_DOS_Header, (DWORD)* ppdwNames, 0);
pszFunctions.push_back(szFunc);
ppdwNames++;
}
UnmapViewOfFile(lpFileBase);
CloseHandle(hFileMapping);
CloseHandle(hFile);
return true;
};
int main(int argc,char*argv[])
{if (argc < 2) {
fprintf(stderr,"need a dll to demangle as first parameter\n");
exit(-1);
}
std::vector<std::string>pszFunctions;
if (GetDLLFileExports(argv[1], pszFunctions)) {
for (auto s : pszFunctions) {
// undecorate them
char* pUndecorated = __unDNameEx(NULL, s.data(), 0
, _dAlloc, _dFree, _dGetParameter, un_dwFlags);
printf("%s;\n", pUndecorated);
delete[] pUndecorated;
}}
}
Whats next..
There are a few ways I usually head into this sort of work, RE it all and rebuild, write trace and trampoline DLLS that monitor whats going on, and can inject, google for other people doing it (usually do that one last, but so far haven’t seen one! )
With this project I believe writing a DLL that can trace and intercept the data going via LMCMIO.dll is the way to go, Rohitab’s API Monitor will do a lot there, but a proxy/trampoline/interposer DLL is going to be more useful. So lets do that instead…..
Exit stage left.
CURTAIN
Act 1, Scene 2.
(this section is still in editing)
Proxy DLL
Some of the issues with making a proxy C++ DLL are around the name mangling, unlike C you can’t just alias it in the .def file , which is also useful for pass thru.
The issue is that the linker sees the first @ and treats it as the ordinal or something else and terminates the name, so if the mangled name is ?Foo@@bar in the .DEF file , the linker will spit out ?Foo so when you go to load the dll it’ll fail. One way to fix the issue is to demangle the name and have the proxy DLL use the exact same name, which can be a hassle. So my approach was to post process the DLL to change the name, i’ll swap out @ in the name to $ or something that the DEF file will carry thru to the linker. Then we just post process the DLL to rename that $ back to the @.
Example of the original mangled function name
1 0 00001B60 ?MIO_AxisGoOrigin@@YA?AUtagResult@@EGHPAVCWnd@@@Z
demangled it looks like
struct tagResult API MIO_AxisGoOrigin(unsigned char device,unsigned short,int,class CWnd *cWnd);
so in the proxy DLL .def if you do (the aliased function is also changed but that is typical)
?MIO_AxisGoOrigin@@YA?AUtagResult@@EGHPAVCWnd@@@Z=QMIO_AxisGoOriginAAYAQAUtagResultAAEGHPAVCWndAAAZ @1
But what you’ll get is :-
?MIO_AxisGoOrigin$$YA?AUtagResult
Which of course isn’t great. compiling it as the demangled should be ok, however name mangling can change so its not always the best way to do it. So with this one, i’m going to replace the @’s with something else and then replace it in the resulting binary instead. It’d be great to find out yet another way, no amount of quoting in the DEF seems to fix it. But the SaR is usually fine.
A proxy DLL simply exports the original function names in its DLL and then internally loads the original DLL which is usually renamed. It then constructs a trampoline to jump to the original function
hL would be the original DLL, and we fetch the pointer to the original function
p[0] = GetProcAddress(hL, “?MIO_AxisGoOrigin@@YA?AUtagResult@@EGHPAVCWnd@@@Z”);
For x86 you can just inline __asm the jump to the original function. Later on adding extra code to dump what its doing etc. For x64 it’d be an external .asm file. So far all the laser stuff is 32 bits so just covering that for now
extern “C”” {
void QMIO_AxisGoOriginAAYAQAUtagResultAAEGHPAVCWndAAAZ() {__asm
{ jmp p[0 * 4]
}
}
}
Whats going on here is a DLL function lives at a memory address, GetProcAddress returns that address in memory. Instead of the original DLLs address we return our functions address, then after we run our code it jumps to the old DLL address and continues the function as normal, we can snoop, change data skip it. and so on.
DLLs can do some interesting things like we can have it bypass our DLL and jump straight to the original function, in the original DLL as well.
Build the proxy DLL
I have a modified version of https://www.codeproject.com/Articles/16541/Create-your-Proxy-DLLs-automatically for this, there is also Proxify
This the skeleton proxy function for MIO_AxisGoOrigin in LMCIO.DLL, it saves the flags and registers, then prints a message to the internal debug system in windows, then jumps to the original function.
Starting with LMCMIO.dll
// struct tagResult __cdecl MIO_AxisGoOrigin(unsigned char,unsigned short,int,class CWnd *)
// ?MIO_AxisGoOrigin@@YA?AUtagResult@@EGHPAVCWnd@@@Zextern "C" __declspec(naked) void __E__0__()
{
__asm pushad
__asm pushfd
OutputDebugStringA("struct tagResult __cdecl MIO_AxisGoOrigin(unsigned char,unsigned short,int,class CWnd *)\n");
__asm popfd
__asm popad
__asm
{jmp procs[E__MIO_AXISGOORIGIN__YA_AUTAGRESULT__EGHPAVCWND___Z*4];
}
}
This code reads the address of the original function, and stores it for use in the proxy function
procs[E__MIO_AXISGOORIGIN__YA_AUTAGRESULT__EGHPAVCWND___Z] = GetProcAddress(hL,”?MIO_AxisGoOrigin@@YA?AUtagResult@@EGHPAVCWnd@@@Z”);
if( procs[E__MIO_AXISGOORIGIN__YA_AUTAGRESULT__EGHPAVCWND___Z] == NULL ) { OutputDebugStringA("Failed to get proc address ?MIO_AxisG
It replaces the ? and @’s with _ so that it will compiler properly as they are not valid C++ function names and we’ll deal with the binary later.
So stepping back slightly and generating a DLL to show the mangling issue as it appears , making a .DEF file that uses the mangled names
EXPORTS
?MIO_AxisGoOrigin@@YA?AUtagResult@@EGHPAVCWnd@@@Z=__E__0__ @1?MIO_Close@@YAXH@Z=__E__1__ @2
?MIO_Close@@YAXXZ=__E__2__ @3
?MIO_Cmd@@YA?AUtagResult@@EGGGGGG@Z=__E__3__ @4
?MIO_DisableLaser@@YA?AUtagResult@@E@Z=__E__4__ @5
Dumpbin /exports of the proxy.dll we can see the alias to the proxy function.
1 0 00011050 ?MIO_AxisGoOrigin = @ILT+75(___E__0__)
2 1 0001104B ?MIO_Close = @ILT+70(___E__1__)3 2 00011046 ?MIO_Close = @ILT+65(___E__2__)
4 3 00011073 ?MIO_Cmd = @ILT+110(___E__3__)
5 4 00011055 ?MIO_DisableLaser = @ILT+80(___E__4__)
6 5 0001106E ?MIO_ENABLEZ = @ILT+105(___E__5__)
7 6 00011069 ?MIO_EarseEpprom = @ILT+100(___E__6__)
The typo in the API Earse makes me think of the Fast Show’s ERAS videos.
If we replace the LMCMIO.dll with our proxy, what happens? I’m building it on 2019 but compiling with 2013 toolset.
Renaming the original LMCMIO.dll to LMCMIOold.dll and copying in the proxy dll to the same folder as EzCad2 and trying it, nothing happens. The app just exits with no warnings, but why? Well it’s going to be an issue with the DLL name issue mentioned earlier, when windows tries to load functions from our proxy DLL it’ll fail, because the names are wrong, the oridinals are right but its rare anyone loads by index and not name, especially C++, how do we see this?
Windows has plenty of tools for this. We need the windows debugging tools, windbg x84 and gflags.exe. Gflags is going to allow us to turn on the internal DLL load tracing, so that we can see whats happening behind the scenes without any extra work.
Switch on SLS(show loader snaps) mode for EzCad2 and the DLL just so we can watch it later. Don’t forget to turn it off after we’re done as it generates a lot of data and will slow things down.
From the command line
gflags.exe -i EzCad2.exe +sls
gflags.exe –i LMC1.dll +slsgflags.exe –i LMCMIO.dll +sls
C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\gflags.exe" -i EzCad2.exe +sls
Current Registry Settings for EzCad2.exe executable are: 00000002sls – Show Loader Snaps
DLLs also cascade load, that is the app loads a DLL, and that DLL loads another DLL. So I added the snap loader tracer to the LMC1.dll as well. WinDepends is a good place to start poking at DLL load order, as well windbg.
Next load windbgx86 and open the executable, EzCad2.exe.
There are a different modes for DLL loading sometimes its handled by windows on program start, sometimes its explicit code, or delay loading. In this case its being handled by windows so all we have to do is load it into the debugger and we’ll see the issue straight away without actually running EzCad2
Working backwards we can see LMCMIO failed to load
08bc:2130 @ 1440796701 – LdrpHandleOneOldFormatImportDescriptor – ERROR: Snapping the imports from DLL "C:\ezcad\newer\Lmc1.dll" to DLL "C:\ezcad\newer\LMCMIO.dll" failed with status 0xc0000139
08bc:2130 @ 1440796701 – LdrpLoadImportModule – RETURN: Status: 0xc0000139
08bc:2130 @ 1440796701 – LdrpHandleOneOldFormatImportDescriptor – ERROR: Loading "????" from the import table of DLL "C:\ezcad\newer\EzCad2.exe" failed with status 0xc0000139
08bc:2130 @ 1440796701 – LdrpInitializeProcess – ERROR: Walking the import tables of the executable and its static imports failed with status 0xc0000139
08bc:2130 @ 1440796701 – _LdrpInitialize – ERROR: Process initialization failed with status 0xc0000139
08bc:2130 @ 1440796701 – LdrpInitializationFailure – ERROR: Process initialization failed with status 0xc0000139
eax=00000000 ebx=7734206c ecx=0018f928 edx=0018f929 esi=c0000139 edi=7efdd000
eip=7725fcc2 esp=0018fcb0 ebp=0018fd00 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!NtTerminateProcess+0x12:
7725fcc2 83c404 add esp,4
Going back in the windbg logs
08bc:2130 @ 1440796701 – LdrpSnapThunk – WARNING: Hint index 0x23 for procedure "?MIO_OpenNewDev@@YAHXZ" in DLL "LMCMIO.dll" is invalid
08bc:2130 @ 1440796701 – LdrpSnapThunk – ERROR: Procedure "?MIO_OpenNewDev@@YAHXZ" could not be located in DLL "LMCMIO.dll"(8bc.2130): Unknown exception – code c0000139 (first chance)
08bc:2130 @ 1440796701 – LdrpGenericExceptionFilter – ERROR: Function LdrpSnapIAT raised exception 0xc0000139
So it tried to load ?MIO_OpenNewDev@@YAHXZ from LMCMIO.dll which is the proxy DLL (Which this is an expected failure)
Going back to the .DEF file lets look at the function
?MIO_OpenNewDev@@YAHXZ=__E__35__ @36
Thats what it ought to look like, the ordinal is correct but its been terminated at the @@ , lets check whats in the actual DLL
dumpbin /exports LMCMIO.dll
36 23 00011177 ?MIO_OpenNewDev = @ILT+370(___E__35__)
And there it is, the proxy alias is there , which the = @ILT part. So even though the .DEF is correct, the linker has terminated at the @ because thats the token to specify the ordinal (an ordinal is a numerical index for a function, versus a name)
So now we have to go back and fix this issue. I’ve already modified my dll proxy tool to correct the names in the C++ code (basically replacing the ?/@ with _ ) but the .DEF file still generates the C++ mangled name. I have to next modify the app to also spit out the new names in the .DEF then post process the DLL to put the original C++ mangled names back.
taking a break for dinner….
Post Processing the proxy DLL
After some dinner we restart.
So the plan is to change the proxy dll maker tool to output the sanatised names to the C++ code and the .DEF file, so instead of @ and ? it will substitute them for Q and A then after the DLL is compiled a, make a second tool that parses the original DLL exports and then sanatises them in the same way , read the proxy dll and search and replace the sanatised version with the original…
After modding the dll proxy tool, and compiling it , next is throwing together a quick SAR tool. ugh the double space wordpress html nonsense… i’ll clean it up on a edit pass.
// DLLSar.cpp : This file contains the ‘main’ function. Program execution begins and ends there#include <windows.h>
#include <iostream>
#include <string>
#include <fstream>#include <streambuf>
#include <algorithm>
#include <vector>
std::vector<std::string> defList;
std::vector<std::string> replaceList;
// list of previously used names this run
std::vector<std::string> previouslyOnSAR;
// list of strings to backlist ( no replacement )
std::vector<std::string> blackListSAR;
bool SAR(const std::string& searchString, const std::string& replaceString, std::string& replaceBuffer)
{bool found = false;
size_t pos = 0;
if (searchString.length() != replaceString.length()) {
std::cout << "bad replace" << std::endl;exit(-4);
return false;
}
// reset
pos = replaceBuffer.find(searchString);while (pos != std::string::npos)
{
// replace bufer.
std::cout << "search = " << searchString << " replace " << replaceString << std::endl;
replaceBuffer.replace(pos, searchString.size(), replaceString);
found = true;
std::cout << "-";
// find next
pos = replaceBuffer.find(searchString, pos + replaceString.size());
}
return found;
}
bool exportProcAddresses(void* hModule)
{#if defined( _WIN32 )
unsigned char* lpBase = reinterpret_cast<unsigned char*>(hModule);IMAGE_DOS_HEADER* idhDosHeader = reinterpret_cast<IMAGE_DOS_HEADER*>(lpBase);
if (idhDosHeader->e_magic == 0x5A4D)
{
#if defined( _M_IX86 )
IMAGE_NT_HEADERS32* inhNtHeader = reinterpret_cast<IMAGE_NT_HEADERS32*>(lpBase + idhDosHeader->e_lfanew);#elif defined( _M_AMD64 )
IMAGE_NT_HEADERS64* inhNtHeader = reinterpret_cast<IMAGE_NT_HEADERS64*>(lpBase + idhDosHeader->e_lfanew);#endif
if (inhNtHeader->Signature == 0x4550){
IMAGE_EXPORT_DIRECTORY* iedExportDirectory = reinterpret_cast<IMAGE_EXPORT_DIRECTORY*>(lpBase + inhNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
std::cout << "Procesing DLL" << std::endl;
for (register unsigned int uiIter = 0; uiIter < iedExportDirectory->NumberOfNames; ++uiIter)
{
char* szNames = reinterpret_cast<char*>(lpBase + reinterpret_cast<unsigned long*>(lpBase + iedExportDirectory->AddressOfNames)[uiIter]);
//printf("%s\n", szNames);
if (std::find(blackListSAR.begin(), blackListSAR.end(), szNames) != blackListSAR.end()) {std::cout << "matched " << szNames << " skipped " << std::endl;
continue;
}
defList.push_back(szNames);
}return true;
}
}
#endif
std::cerr << "DLL processing failed" << std::endl;return false;
}
bool parseDLL(const char* dllName)
{std::cout << "Parsing " << dllName << std::endl;
HMODULE lib = LoadLibraryExA(dllName, NULL, DONT_RESOLVE_DLL_REFERENCES);
if (!lib) {
std::cerr << "load lib failed" << std::endl;return false;
}
// empty the list
defList.clear();
return exportProcAddresses(lib);
}
std::string sanatise(std::string& name)
{std::string output = name;
for (uint16_t i = 0; i < name.length(); i++) {
if (name.at(i) == ‘?’) {output.at(i) = ‘Q’;
}
if (name.at(i) == ‘@’) {
output.at(i) = ‘A’;
}
}
return output;
}
int main(int argc, char* argv[])
{std::string proxyBuffer;
if (argc < 4) {
exit(-1);}
// build list of exports from original DLL
if (parseDLL(argv[1]) == false) {exit(-2);
}
// proxied DLL
try {std::ifstream inputFile(argv[2], std::ios::in | std::ios::binary | std::ios::ate);
std::vector<char> dataVector(inputFile.tellg());
inputFile.seekg(0, std::ios::beg);inputFile.read(dataVector.data(), dataVector.size());
proxyBuffer.assign(dataVector.begin(), dataVector.end());
}catch (std::ofstream::failure & readErr)
{
std::cerr << "\n\nFail occured when reading from file " << argv[2] << " "
<< readErr.what()
<< std::endl;
return -3;
}
uint16_t index = 0;
// build list of replacements.
for (auto originalName : defList) {std::cout << originalName << "\n" << sanatise(originalName) << "\n";
replaceList.push_back( sanatise(originalName));
}
index = 0;
// replace them
for (auto originalName : defList) {
if (SAR( replaceList.at(index), originalName, proxyBuffer)) {std::cout << "Y";
}
else {
std::cout << "n";
}
index++;
}
std::cout << "\n" << "Writing output file " << argv[3] << std::endl;
{try {
std::ofstream outputFile(argv[3], std::ios::out | std::ios::binary);
outputFile.write(proxyBuffer.data(), proxyBuffer.length());
}
catch (std::ofstream::failure & writeErr) {
std::cerr << "\nFail occured when writing to the output file " << argv[3] << " "
<< writeErr.what()
<< std::endl;
return -2;
}
}
}
After making the changes to the DLL proxy tool, the exports of the DLL now look like this, ( the ?s become Q and the @ becomes an A)
1 0 00011050 QMIO_AxisGoOriginAAYAQAUtagResultAAEGHPAVCWndAAAZ = @ILT+75(___E__0__)
Running the SAR code using the original dll and proxied dlls as input, and an output name.
Looking at the output file with dumpbin /exports we see its changed as expected
1 0 00001B60 ?MIO_AxisGoOrigin@@YA?AUtagResult@@EGHPAVCWnd@@@Z
It correctly demangles as well, so lets see if it loads.
Testing in WinDBG X86
Lets try windbgx86 again. making sure to add +sls to the proxy dll with gflags, since it is the actual file that stores those changes and we’ve liekly overwritten it.
ModLoad: 0fe80000 0fea6000 C:\ezcad\newer\LMCMIO.dll
5754:2ecc @ 1448637171 – LdrpMapViewOfSection – RETURN: Status: 0x000000005754:2ecc @ 1448637171 – LdrpFindOrMapDll – RETURN: Status: 0x00000000
5754:2ecc @ 1448637171 – LdrpHandleOneOldFormatImportDescriptor – INFO: DLL "C:\ezcad\newer\LMCMIO.dll" imports "KERNEL32.dll"
5754:2ecc @ 1448637171 – LdrpLoadImportModule – ENTER: DLL name: KERNEL32.dll DLL path: C:\ezcad\newer;;C:\Windows\system32;C:\Windows\system;C:\Windows;.;C:\Program Files (x86)\Windows Kits\10\Debuggers\x86;C:\msys64\usr\bin;C:\msys64;C:\msys64\usr\bin;C:\Python36\Scripts\;C:\Python36\;C:\Python37;C:\Program Files\NVIDIA GPU Computing Toolkit\CUDA\v10.1\bin;C:\Program Files\NVIDIA GPU Computing Toolkit\CUDA\v10.1\libnvvp;C:\Program Files\Git LFS;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\
Great, no errors on Loading so lets try running EzCad2.
Now we see the debugger spit out the following
int __cdecl MIO_Open(int)
Which is what was expected, it is at least now loading our trampoline function which is just a simple debug string output for now.
// int __cdecl MIO_Open(int)
// ?MIO_Open@@YAHH@Zextern "C" __declspec(naked) void __E__34__()
{
__asm pushad
__asm pushfd
OutputDebugStringA("int __cdecl MIO_Open(int)\n");
__asm popfd
__asm popad
__asm
{jmp procs[E_QMIO_OPENAAYAHHAZ*4];
}
}
OK, so now we are inside our function, the proxy dll is working so far but I initially left in some debug code for testing proxy DLLs that made it keep looping the function. After rebuilding the proxy DLL I ran EzCad2 again in WinDbgx86 and :-
All working and the original DLL is also being called, we can see the debug trace calls to the functions being shown in the debug viewer, SLS is still on so it is much noiser output than normal.
We can disable SLS for now. Just run gflags with –sls on the exe, and two dlls (Technically I haven’t tried it against the laser module, but trampoline/proxies generally either just work or they crash it is very rarely inbetween)
(3fe8.53a0): Break instruction exception – code 80000003 (first chance)
eax=00000000 ebx=00000000 ecx=94b00000 edx=0008e3c8 esi=fffffffe edi=00000000eip=772e10a6 esp=0018fb08 ebp=0018fb34 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!LdrpDoDebuggerBreak+0x2c:
772e10a6 cc int 3
0:000> g
ModLoad: 75ec0000 75f20000 C:\Windows\SysWOW64\IMM32.DLL
ModLoad: 76d90000 76e5e000 C:\Windows\syswow64\MSCTF.dll
ModLoad: 00c00000 00c38000 C:\Windows\SysWOW64\odbcint.dll
DllMain called
DllMain DLL_PROCESS_ATTACH
ModLoad: 00c50000 00c5c000 C:\ezcad\newer\LMCMIOOLD.DLL
ModLoad: 70700000 70780000 C:\Windows\SysWOW64\uxtheme.dll
ModLoad: 75fc0000 75fef000 C:\Windows\syswow64\WINTRUST.dll
ModLoad: 75510000 75632000 C:\Windows\syswow64\CRYPT32.dll
ModLoad: 75750000 7575c000 C:\Windows\syswow64\MSASN1.dll
ModLoad: 6f1a0000 6f1a9000 C:\Windows\SysWOW64\hid.dll
int __cdecl MIO_Open(int)
ModLoad: 03080000 031df000 C:\Windows\SysWOW64\ole32.dll
ModLoad: 026f0000 02703000 C:\ezcad\newer\PLUG\AngleRotate.plg
ModLoad: 02730000 02743000 C:\ezcad\newer\PLUG\AngleRotate2.plg
ModLoad: 025a0000 025aa000 C:\ezcad\newer\PLUG\ChangeText.plg
ModLoad: 02750000 02775000 C:\ezcad\newer\PLUG\GlobeMark.plg
ModLoad: 02710000 02720000 C:\ezcad\newer\PLUG\IPGSet.plg
ModLoad: 02780000 02797000 C:\ezcad\newer\PLUG\jczfont.plg
ModLoad: 027a0000 027b2000 C:\ezcad\newer\PLUG\MultiFileMark.plg
ModLoad: 027c0000 027dd000 C:\ezcad\newer\PLUG\MultiPartMark.plg
ModLoad: 02af0000 02b25000 C:\ezcad\newer\PLUG\PowerRuler.plg
ModLoad: 03080000 030a7000 C:\ezcad\newer\PLUG\ReadFace3d.plg
ModLoad: 6b6e0000 6b7a8000 C:\Windows\SysWOW64\OPENGL32.dll
ModLoad: 6d260000 6d282000 C:\Windows\SysWOW64\GLU32.dll
ModLoad: 030b0000 030d3000 C:\ezcad\newer\PLUG\RingMark.plg
ModLoad: 02b40000 02b5b000 C:\ezcad\newer\PLUG\RingTextMark.plg
ModLoad: 030e0000 03102000 C:\ezcad\newer\PLUG\RotaryMark.plg
ModLoad: 02c50000 02c6a000 C:\ezcad\newer\PLUG\RotateText.plg
ModLoad: 03110000 03135000 C:\ezcad\newer\PLUG\Splitmark2.plg
ModLoad: 03140000 03152000 C:\ezcad\newer\PLUG\SuperProject.plg
ModLoad: 70b60000 70cfe000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.DLL
ModLoad: 745b0000 745be000 C:\Windows\SysWOW64\DEVRTL.dll
int __cdecl MIO_Open(int)
struct tagResult __cdecl MIO_GetLmcInfo(unsigned short * const)
struct _GUID __cdecl MIO_GetClassGUID(void)
void * __cdecl MIO_GetDevHandle(int)
void * __cdecl MIO_GetDevHandle(int)
void * __cdecl MIO_GetDevHandle(int)
void * __cdecl MIO_GetDevHandle(int)
void * __cdecl MIO_GetDevHandle(int)
void * __cdecl MIO_GetDevHandle(int)
void * __cdecl MIO_GetDevHandle(int)
void * __cdecl MIO_GetDevHandle(int)
DllMain called
DllMain DLL_PROCESS_DETACH
eax=00000000 ebx=00000000 ecx=00000002 edx=00000000 esi=77342100 edi=773420c0
eip=7725fcc2 esp=0018fe70 ebp=0018fe8c iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000246
ntdll!NtTerminateProcess+0x12:
7725fcc2 83c404 add esp,4
Much less noiser output in the debugger .It also looks like the PLG plugins are actually DLLs since they’re being ModLoaded
We can see now that it is using MIO_Open, MIO_GetLmcInfo, MIO_GetClassGUID, MIO_GetDevHandle
Now I can actually start intercepting the calls and look at the data going by.
Since I was writing the code and the write up at the same time, it is time for another break for the evening and back for the rest of the intercept tomorrow!
So far changes to the proxy making application that can handle C++ name mangling with the post process SAR Tool and a basic Proxy DLL for LMCMIO, as well as figuring out the keyboard F1 and F2 code.
Onto stage 3!
Work in progress
Making a more useful trampoline is pretty straightforward
Add a couple of helper functi0ns that print out parameters, add some global storage (which in a DLL can be a fussy affair but lets start with simple)
static char temp_buffer[1024];
void dump_ret_param(unsigned int paramindex, unsigned int count, unsigned int offset){
static char temp_buffer[1024];
while (count–) {
sprintf_s(temp_buffer, sizeof(temp_buffer), "param%d=0x%x, ", paramindex, param[paramindex][offset]);
OutputDebugStringA(temp_buffer);
paramindex++;
}
OutputDebugStringA("\n");
}
void dump_return(unsigned int offset)
{static char temp_buffer[1024];
sprintf_s(temp_buffer, sizeof(temp_buffer), "returns=0x%x\n", param[0][offset]);
OutputDebugStringA(temp_buffer);
}
then we can modify the call like this, we replace the return address back to the caller with our own, so the program flow now goes :-
caller –> trampoline –> original function –> back to end of trampoline –> back to caller
we do this so we can know not only the parameters passed in, but any data returned, in this case EAX, since this is autogenerated code it is somewhat terse
there is an array of arrays for the parameters , upto 20, and an array of return addresses since functions may be called in parallel or from other areas of the dll etc. recursive calls will need something more sophisticated.
extern "C" __declspec(naked) void __E__34__()
{
__asm pushad__asm pushfd
// fetch out the return address__asm mov eax, [esp + 0x24]
__asm mov returnAddress[E_QMIO_OPENAAYAHHAZ * 4], eax
// fetch out the passed in parameter and store it in the param array
__asm {
mov ecx,2 //param indeximul eax,ecx, (E_NUM_PROCS * 4)
mov edx, E_QMIO_OPENAAYAHHAZ
mov ebx, [esp + 0x28]
mov dword ptr param[eax + (edx * 4)],ebx
}
// overwrite the stack ptrs return address, with our return address becase we want to know what the return value is
__asm mov eax, jump_E_QMIO_OPENAAYAHHAZ
__asm mov [esp + 0x24],eax
OutputDebugStringA("int __cdecl MIO_Open(int) ");
dump_ret_param(0,4,E_QMIO_OPENAAYAHHAZ);__asm popfd
__asm popad__asm
{jmp procs[E_QMIO_OPENAAYAHHAZ*4];
}
jump_E_QMIO_OPENAAYAHHAZ:;
__asm pushad
__asm pushfd// show the return code from eax
__asm mov param[E_QMIO_OPENAAYAHHAZ * 4], eaxdump_return(E_QMIO_OPENAAYAHHAZ);
__asm popfd
__asm popad/// back to original caller code
__asm jmp returnAddress[E_QMIO_OPENAAYAHHAZ * 4]}
Dr Terrible's House of Bloggable 
This is really fantastic. Will watch very closely as you progress. I’m a pretty good EE but not at all a CS so this is mostly way beyond me. It would be amazing to have non-ezcad control of these machines.
Would you be willing to add the offline file save patching instructions or perhaps even a small program on github? That would be very helpful. My laser’s chair is uncomfortable and it would be nice to sit at my real desk and do the CAM.
Impressive work indeed! But like previous post, the most practical appeal is in your casual 30-second offline-saving patch…So yeah, a bit more details on that would be great!
the info is really there already, but i’ll consider posting the patch.
Hello Charliex,
Is this a project you are still working on?
When you used this DLL method, were you able to get EZCAD2 to load the MRKCFGx files and edit the Q-Pulse Width Pen settings and save them?
Using the modified DataMgr.dll that patches 8B 44 24 04 with 31 C0 FF C8 allows me to save the .ezd files offline, but using that mod EZCAD does not display the Q-Pulse Width settings used on MOPA Lasers.
I’m looking for a way to edit .ezd files offline at home so I can run them at work on a MOPA Fiber Laser at work.
As I look at it, that mod fakes the response to a SetSoftFunCode check so EAX is loaded with 0xFFFFFFFF and stores that instead of the 0x0000000 response it gets because it didn’t find a “key”
It does not load any of the MARKCFGx files stored in the PLUG directory, so it doesn’t know what type of Machine it is working with.
[ Original DataMgr.dll ]
?gf_SetSoftFunCode@@YAXH@Z:
8B 44 24 04 mov eax, [esp+4]
A3 78 D3 15 10 mov dword_1015D378, eax
C3 retn
[ Modified DataMgr.dll ]
?gf_SetSoftFunCode@@YAXH@Z:
31 C0 xor eax, eax
FF C8 dec eax
A3 78 D3 15 10 mov dword_1015D378, eax
C3 retn
hey steve,
i only ever really wanted it for editing graphics, i use my ezpen editor to handle all the brushes. it shouldn’t be too difficult to have it load the config files . i dont have the machine in front of me to check but can you set the type in the params ?
i’ll try to have a look thru it when i’m on it next
from a quick look its because ezcad.exe tries to open the lmc driver, fails to find the hardware, or valid device then can’t init the device or load the settings. gf_ReadLmcCfg/gf_GetCf doesn’t get called. look at the function at 0xFFA92 in EzCad2.exe.
I see where those imports are being called, but I’m thinking somewhere inside LMC1/LMCMIO it sets up buffers based on what board it found and without those being setup, I can’t get the CFG files to load without crashing EZCAD2.
The way the hack was done to save files doesn’t allow us to access the Params, F3 is greyed out.
It also seems to cause weird problems when I create and save complex .ezd files using the hacked DataMgr.dll and I’m not sure if it’s related to not having any of the CFG data loaded.
So far only really simple files work on the laser if I program them off-line.
Anything complex and it wigs out and starts lasering about 20x the size of what I’m working on.
I’d really like to make a true working Off-Line seat with all of the functions like when I’m plugged into the unit.
Maybe I can see about buying a BJJCZ LMCV4-Fiber Motherboard and making a “Dummy” controller for EZCAD2 to see so it thinks it’s connected to the laser….
yeah once i learnt that lightburn was coming out with an ez/lmc compatible version it didn’t seem worthwhile investing too much time into ezcad, so i mostly put the other apps on hold. especially given ezcad2 is discontinued for a while now
certainly could be the config file being missing that it gets wiggy, though its never been the most stable of programs and all the patch does is change the status of the dog..
i’d imagine there are some callbacks/other routines added once ezcad believes the hardware is there so that might cause crashes too. making a proxy dll for the lmc might also be a way to go too.
might better buying an ezcad3 upgrade for your laser then swapping out the lmc1 ,though i haven’t checked if 3 and 2 can share projects as to whether or not that’d make sense
cheers
2.14.11
Comparison of C:\ezcad\newer\DataMgr.dll and C:\ezcad\newer\DataMgr_2.dll
5/16/2020 4:05:56 PM
modded
—————————————————–
LFB120 A1 88 E4 15 10 C3 90 90 90 90 90 90 90 90 90 90 31 C0 FF C8 A3 88 E4 15 10 C3 90 90 90 90 90 90 ¡ˆä..Ã1À.È£ˆä..Ã
original
RFB120 A1 88 E4 15 10 C3 90 90 90 90 90 90 90 90 90 90 8B 44 24 04 A3 88 E4 15 10 C3 90 90 90 90 90 90 ¡ˆä..ËD$.£ˆä..Ã
Thanks for posting this info! This is a level that I can comprehend and replicate 😉
A quick search and edit with HxD did the trick.
The pen tool is a really powerful tool for making test grids, one that many folks would really appreciate. Have you thought about making a similar tool which lets you quickly update the hatches for existing objects?
I would make a donation for a toolset that allows easy generation of a test grid where you can enter the start/stop freq, power and specify hatch settings (thinking based on existing object pattern in EZCAD). I would like to think I’m not the only one who would.
on a side note the mod for saving isn’t working on the 2.14.11 release posted here: https://ezcad.com/index.php?/files/file/5-ezcad-2-software/
Same from my side…I can also think of a donation for a tool allowing easy manipulation of hatch settings…
There is a checkbox where you set the prompt to come up when you hit f2. or the footpedal. You then have to hit enter key or click continue box. way safer, but slower obviously.
thanks john. yeah i wish they’d let you remap it in the options
Hi. i am from Turkey. i wish you can contact me via mail or facebook i’d like to ask if something is doable since you can edit so much in ezcad2. i have an other fiber laser called ARGES and coder is a turkish guy so i reached out to him and he said its doable in his software and he did it. Now i have a third option other than “show contour” and a simple red square and it made my life hell of a lot easier since i have this option. if you could just contact me i’d like to explain myself with some photos also. thanks in advance my facebook is thewalek@hotmail.com
sure just email contact at nullspacelabs com
This is great stuff, thank you! Have you looked at editing the MarkParam.lib? This would be great for moving settings for one lens to another lens (change power use rule of three).
thanks!, . i haven’t, i’d been using different setup files to switch lenses, i can take a look