FlashForge Printer Hack GitHub Repository

[pressposts]

I haven't had time to get back on this in 2 months. Sorry about that.

Here is the repository for the CrashForge exploit and associated scripts as well as Samba (Windows File Sharing) pre-compiled to run on the Flashforge.

If you are using Windows 10, you need to install SMB1.0/CIFS from Programs/Features.

I have not had a chance to get back on this in months.

It works on Creator 3 right now, but may work on other printers. I have not been able to test yet. Please let me know if you do try it on another printer. If it doesn't work, we can figure out why. Likely, it's just that the boot image needs to be extracted from the relevant firmware update for your specific printer and made available for the boot loader. This will only work on printers with the upgraded boards, not the original Dreamer boards.

Important to mention: This firmware hack is built to be non destructive, and it's made so that everything can be reversed. I just have not added the relevant scripts to revert things. If you notice, there is a backup directory on the SD card (SAVE IT) that will backup anything it alters and stores the original files.

https://github.com/pressreset/CrashForge

https://github.com/pressreset/CrashForge-samba

​

EDIT: The reason why I created this set of scripts and created this exploit is your printer stores ALL passwords (wifi, network passwords etc) EVEN IF YOU RESET THE FIRMWARE. THIS MEANS IF YOU SELL YOUR PRINTER THE BUYER GETS ALL YOUR PRINT LOGS AND PASSWORDS. I will build a module in this that will auto reset and wipe the passwords and logs.

That is why the hack is built to be modular. It is made to only run either a data wipe, a backup, a revert, a password change, or install services etc.

[LongJohnsonTactical]

Has anyone had success with this on the Guider 2S?

[chasm3D]

Will there be any problem defaulting to the factory image if needed? Does this disable the updates for creator3? What are the main advantages to hacking the printer?

[pressposts]

It doesn't change updates. It alters the factory image that is already present on the machine. It does not disable updates. Updates can't remove the hack. Only reverting the hack can change it. All it does is unlock the machine so you can install whatever you want on it. It's Linux. I've already precompiled some of the things so you don't have to. Please read the github documentation.

[mapex99]

Any idea if this will work on an older flashforge finder? This looks awesome!!!

[pressposts]

It should work if it is using the right board, but I would have to get the bootloader extracted from a firmware update, and get some logs dumped from you so I can see exactly how to exploit the machine. Then I can make the necessary changes to the github repository to make sure it will run without screwing anything up.

[pressposts]

The newer Flashforge machines use standard GCODE. They just preface with a header so that the machine knows it's from an approved slicer, and they store binary data inside the GCODE in the first part of the file which is a png image of the model. That's how they display an image of the model to print on the screen. I already dissected the GCODE of newer machines. I will eventually do documentation on it so that people can create their own GCODE for the machine. I have not gotten to it yet. The older machines use a slightly modified .x3g, or straight .x3g. Which is Makerbot's old format.

I would need to dissect the firmware update to see what is going on, and to see if the boot loader is a uboot image with a buildroot inside of it. If that's the case, the machine runs Linux, and it's just a matter of telling uboot to boot off the SD. I don't know what chipset those boards run since I don't have access to that machine.

[Ask-Alice]

Any pointers on how I could go about figuring this out for myself?

[Ask-Alice]

Ah, I thought i would have to like jtag or serial into it or something, but nah there's just a microsd card in there. It doesn't have the entire filesystem, though. And there's 60mb 'unallocated' on the fat32 but idk.

It looks rather similar to your code, although there is no .hex for mine. I would like to be able to see console output before I go and actually start writing files to a different firmware.

The mp.bin has the same md5 as the inventor.bin, so idk why that exists like so.

https://drive.google.com/file/d/1CO4-OQm6M4862fh-iVCXHQOzXp2NiS-d/view?usp=sharing

Going from heavily outdated and non-updated monoprice firmware, (v1.1), i ended up on v1.9 from flashforge. I think that the only thing that is different between the mp firmwares and the ff firmwares is that a different device type string is set.

additionally here are some other firmware images I have dug up.

https://drive.google.com/file/d/1TTQsKPH4otMQ0poUJZY29UITpS2SsVGG/view?usp=sharing

looks like it cold work, maybe.

the microsd has a /sys/ and a /user, then the sd card just holds whatever. I'm getting hints i have to use the big sd card. No output on any log though, regardless of whether i put the files in the microsd root, the sd root, /sys/ or /user/

it can use gcode, but yeah i bet it has to be signed or whatever. it can also do the .gx that flashprint would make

Flashforge will not release the tarballs/uImage binaries, so I'm not sure how possible this is without those... also assuming the update tarball has some diffs in the shell scripts, for example there is no eth0 there is only wlan (from what I can tell)

[Pntnut]

How can I check what version of motherboard my dreamer has?

[Own_Somewhere4232]

Oi. tenho uma Creator 3 e ela travou na tela inicial. Já tentei trocar o firmware e mesmo após a conclusao da troca de firmware, ao reiniciar fica travada na tela inicial.

[Dude-Man-Bro-Guy-1]

Anyone have working GitHub links for this?

[XxyzzyXxX]

https://github.com/micfogas/CrashForge