Reverse engineering Bambu Connect: Difference between revisions

Bambu Connect is an [[Help:Electron|Electron]] App with [[security through obscurity]], which makes it inherently insecure.<noinclude>

The purpose of this guide is to demonstrate the trivial process of extracting the ''"private keys"'' used for communicating with Bambu devices to examine, and challenge, the technical basis for Bambu Lab's security justification of Bambu Connect.

To read the main.js for further analysis or extracting the private key stored by Bambu in the app:

#Use the MacOS .dmg file, not the exe. Finding the needed decryption code is easier in the .dmg

#Extract ''bambu-connect-beta-darwin-arm64-v1.0.4_4bb9cf0.dmg''<ref>https://public-cdn.bblmw.com/upgrade/bambu-connect/bambu-connect-beta-darwin-arm64-v1.0.4_4bb9cf0.dmg</ref>, in there you can find the files of the underlying Electron app in <code>Bambu Connect (Beta).app/Contents/Resources</code> folder.

#The app uses asarmor to prevent easy reading, the key is stored in the mach-o binary located here: <code>/Bambu Connect (Beta).app/Contents/Resources/app.asar.unpacked/.vite/build/main.node</code> and can be extracted. Unpacking app.asar without fixing it first will result in an encrypted main.js file and 100 GB of decoy files generated, don't try it.

#Load main.node in Ghidra and Auto-Analyze it. Then search for the GetKey function, or press G and go to <code>0000b67e</code><ref>https://www.reddit.com/r/OrcaSlicer/comments/1i2t6l8/comment/m7tuf2i/</ref>

#<code>./src/.vite/build/main.js</code> is minified, use any JavaScript beautifier (for example <code>prettier</code>) to make it better readable. Interesting user code including the private key is at the end of the file.

The private key and certs are further obfuscated, to get cleartext you need to do: Encrypted string from cy() -> ure(string, key) -> RC4 decryption ->  decodeURIComponent() -> final string.

Example Python reimplementation to extract the secrets, easy to run. Copy the content of t from function cy() in main.js and paste it here. After running, you have a private key from Bambu Lab.

=== Purpose of the private key ===

This private key is used for attaching a digital signature to critical operations, such as print jobs and G-code commands. The printer can validate if received MQTT commands are signed by Bambu Connect, and decide to reject them otherwise.

Bambu Lab's thought is that third party software can not generate a valid signature because it does not possess this key. These practices are comparable to DRM and can almost always be bypassed due to Bambu Connect running on the user's PC.

The impact of this key being leaked is that third party software can now access critical operations again.

The private key corresponds to the public key contained in the app's certificate. This certificate is sent to the printer, enabling it to validate the signature.

Bambu Connect additionally encrypts G-code commands and the file path of print operations using the printer's certificate. This appears to be an attempt of actually increasing security by ensuring that no other devices can decrypt it. However, the potential benefits are negated as the command still includes the plain text G-code command or file path, most likely due to negligence or backwards compatibility.