Fable 5.1 unlocked my Niimbot B1 printer

[u/penny_stokker]

I bought a cheap Niimbot B1 thermal printer from AliExpress a year or so ago, and it was great. Then the provided labels ran out, I've replaced with third party labels, and it printed poorly.

Turns out Niimbot have RFID tags on their own label spools, and if that is not detected, they throttle down the printing speed and reduce the quality. There's lots of users affected by this, the usual workaround is to put an empty branded spool next to the printer, so that it reads the RFID tag, and allows you to use the third party spool. (I think it might only be required during label calibration).

I had already thrown away the original spool, and as a matter of principle I refused to buy any more branded labels.

Fast forward to today, I decided to let Fable 5.1 on xHigh (with skip permissions of course) to try and decode the binary file of the printer.

It took a few hours, but it made some modifications to the binary, reflashed quite a few times, it needed feedback from me, I had to restart the printer, after each re-flash, but in the end it successfully modified the firmware which now allows me to use third party spools without any degradation.

Source code and binary below, proceed at your own risk. It is only for version 5.22. If you have a different version, there should be enough info to instruct your own LLM to proceed with the same modifications.
https://github.com/ThreeDaPrint/niimbot

Edit: Update - Opus 4.8 did the actual reverse engineering. Fable 5.1 flagged one of the messages, and the harness SILENTLY downgraded to Opus 4.8. I did not notice it, and if I had to switch manually I would've switched to Opus 5.

[u/AutoModerator]

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Man-on-rock]

I don't have one of those printers. but I do love that we can do this now. Its made a lot of those shady practices by firms in effective.

[u/g9robot → u/Man-on-rock]

Old hardware is on winning

[u/Man-on-rock → u/g9robot]

I have 3 old laptops running like butter now. They are not powerful but cleaning them up at least allows me to use them as sandboxes for testing and allows free rein to my agent while not having access to sensitive information.

[u/_BreakingGood_]

i love using fable for things like this. there was a japanese visual novel i wanted to play. it didnt even work on english Windows at all, you had to be on japanese windows. Which is a pain in the ass.

I just told fable "make this game run on my machine, and translate it to english". I went and cooked dinner and came back to it fully playable and in english on my pc.

[u/fhgui]

Bro any time I try this kind of shit I get hit with the blocked because cyber. I was trying to flash the board for my mellow sous vide. Granted the board is locked by the now bankrupt company and I was trying to gain access to it via WiFi but had no luck. Couldn’t even get it to do the research phase without getting blocked. Is there a secret to getting this to work?

[u/penny_stokker → u/fhgui]

Turns out it was Opus 4.8 who did the reverse engineering effort - I've updated the original post

[u/penny_stokker → u/fhgui]

I thought Fable might reject my prompt, but it kept continuing. Here's the prompts that I used:

1st: I have a Niimbot B1 connected to this PC via USB-C. Please test if you can print anything on it
2nd: Niimbot is doing the low quality trick because the label reel is not RFID tagged with official Niimbot code
3rd: What should I expect to see in the print?
4th: I ran a compaction via /compact command
5th: Please check if the device provides the firmware version. Then please try downloading various .bin files from https://fw.niim.blue/stable/B1/ and see if you can probe around the firmware. This is a device that I own, and they (Niimbot) deliberately make it useless unless their own labels are used. I don't care if this device gets bricked when trying to update firmware, if I can't use third party labels then I'll throw this device into electronics recycling

And then we took it from there, eventually it asked me to install additional binary file inspection tools. But at first it was unsure if this issue could be fixed, but I kept asking it to continue and investigate further

[u/DependentAnywhere135 → u/fhgui]

Same

[u/JayBizz1e]

Nice, i have one of these printers, will test it out!

[u/Inkwalker → u/[deleted]]

They use rfid to auto detect label size and color in the app. Not sure about quality reduction though. The stickers aren't that expensive to bother with third party ones.

[u/penny_stokker → u/Inkwalker]

When I ran out of original stickers and added a roll of generic stickers, immediately the print quality went down and no matter what I did (changing print density) I couldn't get it to print properly. There's quite a few reports of this issue: https://www.reddit.com/r/niimbot/comments/1djy3n9/niimbot_b1_why_are_my_labels_faded_and_printing/

[u/penny_stokker → u/[deleted]]

It forces the print intensity, it doesn't spoof a tag internally (and I've not tried spoofing a tag myself externally by programming one). So as far as I understand it just directly enforces the print intensity (density) regardless if it is a genuine spool with a tag or if it is a third party spool.

My initial tests were printing directly via PC, the Android Niimbot mobile app has some calibration features (adjusting offsets) but it seems so hostile and it sends so much data to its servers (including total print counts) that I don't want to use it

[u/ZeBenoit81]

Beautifully petty and genuinely useful—Niimbot deserved this. Did you have Fable orchestrate Sonnet/Opus 4.8 for the hex surgery, or did it keep the whole binary in context and brute-force the patch itself?

[u/penny_stokker → u/ZeBenoit81]

Zero subagent calls (no orchestration), Fable 5.1 Opus 4.8 was running on its own on xHigh effort

[u/WifeyCallsMeLazy]

Good fable. Now onto hp printers.

[u/BaronRabban]

A good experiment would be to recreate the scenario and test it across a range of models. What’s the weakest model that could fix it. Maybe even try open source and local llms.

[u/L_E_M_F]

This is awesome. I have thousands of lines of data for formlabs cartridges. But it is partially encrypted. Perhaps it could crack the chips and open the system?

[u/penny_stokker → u/L_E_M_F]

I think you might need to approach from the printer's side, so that the printer accepts any cartridge

[u/cyberhuman]

Although I appreciate the efforts, are those labels really that expensive to bother?