From Cricut Hacking Wiki

Contents [hide] 1 Overview 2 Units 3 Encryption 4 Keys Used

Overview

Command 0x40 is a very versatile command that can make the Cricut move or cut to an absolute position. Four of them can also make the Cricut cut a curve. These commands are encrypted and each type of move/cut seems to use a different key.

Units

• Unit appears to use fixed point units with between 400 and 405 ticks per inch.
• Resolution may be 404 x 400 dpi (roller x stylus).

Encryption

• XXTEA. Reference implementation from wikipedia works fine.
• Each command has its own keyset( TEAs require 4x32bit word keys )
• A separate key may be used to sign information headed back to the PC
• There is one word of random noise in the encrypted data, this makes sure that it is unlikely two commands sent to the same position will have the same output to the cricut. The random noise must be between 10000 and 32767.
• It has become apparent that the command is not embedded in the ciphertext, but instead the command is found by decrypting the 12 byte sentence, with every key, until a result is found with valid arguments( noise > 10000, x < 10000, y < 10000 )
  • The x and y constraint combined with the 404 steps per inch would create a maximum working surface of 24.75"x24.75". In other words no banners larger than 24". Although modified or custom firmware could change this constraint.

Keys Used

• 0 - Cut Line
• 1 - Cut Curve (one Curve is made of 4 of these)
• 2 - Move to these coordinates (X,Y)
• 3 - Lower stylus and cut line to these coordinates (X,Y)
• 4 - Raise stylus and cut line
• 5 - Lower stylus and cut curve (4-command set)
• 6 - Raise stylus and cut curve (4-command set)
• 7 - Used for communicating back to PC

Grab the keys here.

Commands 3-6 appear to be used to ensure a smoother cut. Using commands 3/4 or 5/6 for the first and last line/curve of a path, with the final segment being a duplicate of the first, a complete cut should leave no attached corners.