Hacking the Xyron Design Runner Chapter 1: Homebrew USB Card Reader/Writer

Card Description

It’s time for the “Big Reveal”…

It turns out that the Xyron SD cards cannot be read in a standard SD reader because. They’re NOT SD CARDS!

They’re Atmel Dataflash!

Specifically, the 2MB DataFlash Card as described in the DataFlash Card Overview. And fully detailed in The AT45DB161B Datasheet.

Now how, pray tell, did we find this information out? Funny story. Our original method was to splice a logic analyzer into the disc maker to snoop on the transactions, and watch the bytes go by. There was one that was repeated many many times after each time we hit the save button – it looked suspiciously like a “Write Status” command. Now we didn’t know what the SPI polarities were, although we’d narrowed it down to a few, so we just google searched the words “spi flash status” and all the different permutations of the bits until we hit on one.

spi flash status 0×57

And pow – this byte exists on earth, and does something meaningful! We got our victim – it’s DataFlash! A little more searching revealed that Atmel manufactured (for a while) their DataFlash chips in an SD-card like package. Interesting, but totally bad manners as SD was already a standard. You might be saving your customers a few cents on a socket for your nonconforming device, but it’s like making some cheap no-name cola and putting it in a Coke bottle, just because a Coke bottle is a recognized standard. Fail.

It’s an opportune time to mention that another indicator of the XDR’s coming demise is that the entire “DataFlash Card” product line is already marked as “mature” (ie – dead) and is WAY harder to find than a Xyron card. In fact, if you happen to need a DataFlash card for some crazy old-skool bootloader board or something, just buy an old Xyron Design Runner card – it’s the same thing.

But we said our story was funny, and so far it isn’t. Sorry. Let’s continue, because here’s the funny part.

In our mad rush to buy every bulk XDR Card lot on ebay, we began seeing that some of the cards were not marked with the typical SL874 but rather a chip ID: AT45DCB002. Dammit!! Now with a number like that you can just look it up directly! Did noone ever see that this entire time? Not one person who stuck their card in an SD reader and said “hmmm” had the presence of mind to look on the backside? Well, such is life. Snooping the protocol is a much l33t3r method of ID’ing a chip, anyway.


By this time, you probably have a load of questions buzzing around your head. We’ll take a moment to generate a mini-FAQ Q/A session.


  • Q: If the card is DataFlash, can I use another DataFlash card I have lying around?
  • A: Probably. If your card is the 2MB device, definitely.
  • Q: Can I use a normal SD card?
  • No. You will never be able to use a normal SD card in this device.
  • Q:What about using this DF card in a normal SD reader?
  • A: No, not a normal one. If you could find a firmware-upgradeable SD reader, and rewrite the firmware to use the DF commands and weird page sizes, then yes – that could read it. We searched and couldn’t find one, and anyway – the Teensy is plenty capable.
  • Q: If I use the LUFA libs to program Teensy into a DF flash drive, can Windows see the data? What about Linux?
  • A: No, tried it. Although the LUFA libs are AWESOME, the format is different and Windows will just want to format the device. Furthermore, using the odd page sizes is not trivial, even with heavy mods to the LUFA code. (More than just changing PAGESIZE=). There is some chance that Linux could do it, although we haven’t even tried test 1 to back that statement up.
  • Q: Are all cards the same thing? You’re only referring to one thing, a 2MB DF…
  • A: Yes, they are all the same thing. A font card = blank card = clipart card. Only the data changes. They are all interchangeable in a hardware sense. If you have “doubles” of a card, or an unwanted card – yes, you can reformat it to a blank card for other usage.
  • Q: Can I copy one card to another?
  • A: Yes, although this brings up the sticky point of piracy. We don’t condone it. The manufacturer’s clip art sucks anyway – the point of this project is NOT to copy your girlfriend’s “Romance” Card so you can send her super lovey hearts and roses greetings. The point of this project is to enable users to use THEIR OWN art and fonts on the device, using DIY methods.
  • Q: Can you get me a copy of Romance.bin? I want to send my girlfriend….
  • A: Hell no. Don’t even ask. I would hope that she would dump you for even attempting to use factory clip art anyway. Go make your own romance clip art, and share it under the creative commons license.

Ok, all done with the Q & A time? Let’s move on to hardware.

This entry was posted in Hacks and tagged , , , . Bookmark the permalink.

26 Responses to "Hacking the Xyron Design Runner Chapter 1: Homebrew USB Card Reader/Writer"

Leave a reply