3nh CR4501 RAL 色差仪破解
Colorimeter 3nh CR4501 RAL Hack

原始链接: https://github.com/hallko1234/cr4501-ral-hack

本项目为 3nh CR4501 色差仪提供了固件修改方案,使其无需依赖手机 App 即可直接在内置屏幕上显示最接近的 RAL Classic 色号。同时,该方案还解锁了此前被禁用的导航按钮,以提供更直观的操作体验。 **主要功能:** * **直接显示:** 每次测量后,即时显示最接近的 RAL 色号名称及匹配度。 * **安全与隐私:** 整个过程通过浏览器(Chrome 或 Edge)利用 WebUSB 功能在本地完成。无需上传任何数据至服务器,且不会影响设备原厂校准数据。 * **可逆操作:** 该工具强制要求在刷机前对原始固件进行完整备份,支持随时轻松恢复。 * **高效快捷:** 整个更新过程仅需约五分钟。 **要求:** * Windows 用户需通过 Zadig 安装 WinUSB 驱动程序。 * 本项目包含一个 Python 工具,供希望使用自有 RAL 色卡对设备进行校准的用户使用。 *免责声明:本项目由社区驱动,属于爱好者项目。它并非 3nh 官方产品,不提供任何保修,使用风险由用户自行承担。*

Hacker News 最新 | 往日 | 评论 | 提问 | 展示 | 招聘 | 提交 登录 Colorimeter 3nh CR4501 RAL 破解 (github.com/hallko1234) 5 分,由 Jimmc414 发布于 3 小时前 | 隐藏 | 往日 | 收藏 | 讨论 帮助 考虑申请 YC 2026 年秋季班!申请截止日期为 7 月 27 日。 指南 | 常见问题 | 列表 | API | 安全 | 法律 | 申请 YC | 联系 搜索:
相关文章

原文

Deutsche Fassung

The 3nh CR4501 measures colour very accurately — it just won't tell you which RAL tone that is. For that you're meant to reach for your phone, open an app and pair over Bluetooth.

This modification puts the answer straight onto the device's own display: after every measurement it shows the closest RAL Classic tone with its name and how well it matches. Measure, read, move on.


Everything runs in your browser — nothing is uploaded

Open the tool

Chrome or Edge · five minutes · fully reversible

The tool walks you through it step by step: put the device into update mode, check the driver, back up first, then flash, then try it out. Nothing is uploaded, there is no server, and your device's firmware never leaves your computer.

As a bonus it unlocks the buttons that the factory firmware disables on the measurement screens — left, right and enter start doing what you'd expect.


  • Chrome or Edge. Firefox and Safari cannot do WebUSB.
  • On Windows the device needs the WinUSB driver once, see below.
  • Time: five minutes, four of them waiting.

The one step that takes a bit of feel. The device must be switched off — hold the measure button until it turns off. Then wait at least five seconds without touching anything; without that pause it won't respond.

Option A — hold the measure button again until the ring around it flashes red. Let go immediately.

Option B — press the measure button and the enter button together, pushing the rocker in at its centre. The red flash comes right away; let go at once.

When the ring flashes red the device is ready. The screen stays dark, that's normal.

  1. Plug in over USB, open the tool, Find device
  2. Read and back up — keep that file, it is your way back
  3. Flash — the tool checks every patch location beforehand and aborts on the slightest mismatch
  4. Restart the device, measure, cycle through the views with the enter button

Windows ships no driver for update mode that a browser is allowed to talk to. Zadig sorts that out in a minute:

  1. Plug in the device in update mode
  2. Start Zadig, Options → List All Devices
  3. Select STM32 DownLoad Firmware Update (0483:DF11)
  4. Set WinUSB on the right, then Install Driver

Once only. It must be WinUSB — not libusbK, not libusb-win32. Those work with dfu-util but the browser won't see the device. That is the most common mistake here.


Address Change Size
0x08014288 hook the RAL screen in 4 B
0x0800A9B4 unlock right button 4 B
0x0800A95C unlock left button 4 B
0x0800A920 unlock enter button (read function) 4 B
0x0800A69C unlock enter button (handler) 4 B
0x0802E3D0 RAL screen 1328 B
0x0802E900 colour table, 216 tones with names 3732 B

Seven locations, just over five kilobytes, all inside the application area 0x080040000x0802FFFF.

Nothing above 0x08030000 is touched — splash screen, settings and above all the factory calibration. That is different on every device. Writing a foreign one would make the instrument measure wrong for good, without anyone noticing. The tool refuses any write access up there.

Where the colours come from

216 RAL Classic tones, each colour measured three times. Repeatability averaged 0.08 ΔE, worst case 0.50.

Measured with an original RAL® K5 in semi-matt. Its colour panels are considerably larger than a fan deck's, so the 8 mm aperture sits well inside the panel and catches no edges.

That is not a detail: replica colour cards from the accessories trade often deviate noticeably, sometimes by several ΔE, and they are not consistent among themselves. If your reading disagrees with one of those, the card is usually to blame.

Ten bytes per entry: L, a and b as integers times a hundred, plus the RAL number and a colour value for the display. The names sit behind that as a shared block of word fragments with references rather than repetitions — otherwise they would not have fit into the free memory.

Honestly said: these values come from one fan deck and one device. Fan decks age and yellow, every instrument has its own calibration. For „roughly which RAL is this" that is exactly right. For sign-off or a complaint, reach for the fan deck.

Measuring your own colours

The table shipped here comes from one fan deck and one device. If you want your own values — a different deck, your own device, or simply as a check — the program for that is under werkzeug/ (German).

It measures the 216 colours one after another, checks scatter and duplicate readings, and builds the finished firmware from your own backup at the end. You then flash that in the tool under Restore a backup.

python ral_einlernen.py COM3 --original cr4501_original_....bin

For disassembling or building on: the screen code, the colour table and the original images from development are under referenz/.

None of it is meant to be flashed blindly — least of all the loader, which carries one specific device's factory calibration. The reasons are in the README there.

Memory map, button system, screen handling, measuring the colours, the USB protocol and how to write the permanent memory:

doku/ (German — but the addresses, byte sequences and tables speak for themselves)

Every address in there is verified on the device or in the flash dump. It also records what went wrong and why, which saves the expensive detours.

In the tool, step 5, pick your backup file. If the page is unreachable, this works too:

dfu-util -a 0 -s 0x08004000 -D your_backup.bin

Never use the -t option, and always write the whole region in one go — the bootloader erases everything on the first write command and expects the complete image afterwards.

A weekend project, not a 3nh product, no warranty on anything. Use at your own risk — but with a secured way back, and your device's calibration stays untouched in every case.

If the tool aborts on your device because it doesn't recognise a firmware version, get in touch and I'll take a look.


联系我们 contact @ memedata.com