Reverse engineering Bambu Connect

2025-01-19T18:50:36Z

Vaur: fixed misspell in word principles

Bambu Connect is an Electron App with Security through Obscurity principles, hence it is inherently insecure.<noinclude>

To read the main.js for further analysis or extracting the private key stored by Bambu in the app:

# Use the MacOs .dmg file, not the exe. Finding the needed decryption code is easier in the .dmg
# Extract ''bambu-connect-beta-darwin-arm64-v1.0.4_4bb9cf0.dmg''<ref>https://public-cdn.bblmw.com/upgrade/bambu-connect/bambu-connect-beta-darwin-arm64-v1.0.4_4bb9cf0.dmg</ref>, in there you can find the files of the underlying Electron app in ''Bambu Connect (Beta).app/Contents/Resources'' folder
# The app uses asarmor to prevent easy reading, the key is stored in ./app.asar.unpacked/.vite/build/main.node and can be extracted. Unpacking app.asar without fixing it first will result in an encrypted main.js file and 100 GB of decoy files generated, don't try it.
# Load main.node in Ghidra and Auto-Analyze it. Then search for the GetKey function, or press G and go to 0000b67e<ref>https://www.reddit.com/r/OrcaSlicer/comments/1i2t6l8/comment/m7tuf2i/</ref>
# Write down the hex key, for this build it's B0AE6995063C191D2B404637FBC193AE10DAB86A6BC1B1DE67B5AEE6E03018A2
# Install the npm package asarfix and use it to fix the archive: <code>npx asarfix app.asar -k B0AE6995063C191D2B404637FBC193AE10DAB86A6BC1B1DE67B5AEE6E03018A2 -o fixed.asar</code>
# Now you can extract it in cleartext with <code>npx asar extract fixed.asar src</code>
# ./src/.vite/build/main.js is minified, use any JavaScript beautifier to make it better readable. Interesting user code including the private key is at the end of the file.

=== Extracting certs and private key ===
The private key and certs are further obfuscated, to get cleartext you need to do: Encrypted string from cy() -> ure(string, key) -> RC4 decryption -> decodeURIComponent() -> final string.

Example Python reimplementation to extract the secrets, easy to run. Copy the content of t from function cy() in main.js and paste it here. After running, you have a private key from Bambu Lab.

<pre>
import urllib.parse

def cy():
t = [
# copy from main.js
]
return t

def ure(t, e):
# RC4 implementation
r = list(range(256))
n = 0
s = ""

# Key-scheduling algorithm (KSA)
for o in range(256):
n = (n + r[o] + ord(e[o % len(e)])) % 256
r[o], r[n] = r[n], r[o]

# Pseudo-random generation algorithm (PRGA)
o = n = 0
for byte in t:
o = (o + 1) % 256
n = (n + r[o]) % 256
r[o], r[n] = r[n], r[o]
k = r[(r[o] + r[n]) % 256]
s += chr(byte ^ k)

return s

def lt(t, e):
r = cy()
n = t - 106
s = r[n]
s = ure(s, e)
return urllib.parse.unquote(s)

def extract_certs_and_key():
try:
result = {}
result["Are"] = lt(106, "1o9B")
result["fre"] = lt(107, "FT2A")
result["private_key"] = lt(108, "Tlj0")
result["cert"] = lt(109, "NPub")
result["crl"] = lt(110, "x077")
except Exception as e:
print(f"Error extracting certs/key: {e}")

for key, value in result.items():
print(f"{key}:\n{value}\n")

if __name__ == "__main__":
extract_certs_and_key()
</pre>
</noinclude>

Consumer Rights Wiki - User contributions [en]

Reverse engineering Bambu Connect