clean-room documentation of bambu_networking.dll ready for review

Frix_x commented

2026-05-20 07:10:12 +00:00

Member

Hi, this follows up on our XMPP discussion about reverse-engineering bambu_networking.dll for the baltobu effort.

I've finished putting my documentation into shape and published the repository here: https://github.com/Frix-x/baltobu-reverse-networking

Short summary of what it contains:

PE structure and identification of the VMProtect 3.x protector (packing, anti-debug, anti-VM, import protection).
The unpacking method that produced a clean analysis dump, plus a reproducible analysis pipeline.
A full catalog of the 128 public C exports (107 bambu_network_* and 21 ft_*).
The wire protocol: JSON message schemas with field names, types, optionality, MQTT topics, REST endpoints, and some error codes.
The internals: RTTI class hierarchy, agent struct layout, the cmd_type enum, subsystem log catalog, and a runtime-behaviour document with the call hierarchy, sequence diagrams, and state machines.

Please note that I've put my repo as MIT licensed and respects a clean-room boundary: no decompiled Bambu code is committed, only analysis and documentation. Also Bambu's binary itself is not redistributed (only its SHA-256 for provenance).

How would you like to collaborate from here? I'm happy to adapt the structure, move it under an SFC-managed namespace, align with whatever clean-room process you want to run, or anything else that helps. Let me know what works best on your side.
Also I just discovered the work by Cluster on github that looks to be more advanced because he already started the clean-room reimplementation. The good thing is that he used MITM and I think there's an opportunity to work here and cross-validate both our findings as my work is quite complementary "from the inside". I'll open a ticket on his github as well to open discussion.

Thanks,
Félix

Hi, this follows up on our XMPP discussion about reverse-engineering `bambu_networking.dll` for the baltobu effort. I've finished putting my documentation into shape and published the repository here: https://github.com/Frix-x/baltobu-reverse-networking Short summary of what it contains: - PE structure and identification of the VMProtect 3.x protector (packing, anti-debug, anti-VM, import protection). - The unpacking method that produced a clean analysis dump, plus a reproducible analysis pipeline. - A full catalog of the 128 public C exports (107 `bambu_network_*` and 21 `ft_*`). - The wire protocol: JSON message schemas with field names, types, optionality, MQTT topics, REST endpoints, and some error codes. - The internals: RTTI class hierarchy, agent struct layout, the `cmd_type` enum, subsystem log catalog, and a runtime-behaviour document with the call hierarchy, sequence diagrams, and state machines. Please note that I've put my repo as MIT licensed and respects a clean-room boundary: no decompiled Bambu code is committed, only analysis and documentation. Also Bambu's binary itself is not redistributed (only its SHA-256 for provenance). How would you like to collaborate from here? I'm happy to adapt the structure, move it under an SFC-managed namespace, align with whatever clean-room process you want to run, or anything else that helps. Let me know what works best on your side. Also I just discovered the work by Cluster on github that looks to be more advanced because he already started the clean-room reimplementation. The good thing is that he used MITM and I think there's an opportunity to work here and cross-validate both our findings as my work is quite complementary "from the inside". I'll open a ticket on his github as well to open discussion. Thanks, Félix

❤️ 1

bkuhn commented

2026-05-20 18:30:21 +00:00

Owner

Wow! Very impressive work in such a short time frame!

We now have multiple reverse engineered versions of this library available.

It warms my heart that so many in the community have been so dedicated to make this happen. ❤️

For the time being, I'm pulling all these different approaches into separate branches of this repository so we as a community can evaluate them all. (I should get to adding a branch for you in the next 24 hours).

Note that it's very important that we license these various efforts under the AGPLv3. There are a lot of reasons for this. Most notably, we don't want Bambu to be able to take this code and incorporate it into a reimplemented slicer that is not governed by AGPLv3 at all. Right now, we have a huge benefit that the Bambu networking libraries are themselves governed by AGPLv3, and we don't want to give up that benefit by offering up a non-copylefted reimplementation.

Finally, since what you're saying is that you're offering up to the project something that we can treat as clean room, you're indicating that you did use the binary to help you with the task to give us this. As such, your work has to be licensed AGPL because it's impossible for it to not be a “covered work” under AGPLv3.

For those reasons (and others), I'm going to mirror your branches onto here and apply the AGPL3 to them. (It's easily done, since the MIT license is fully compatible with relicensing under the AGPLv3 in any event.)

Thank you again so much for this work!

Wow! Very impressive work in such a short time frame! We now have multiple reverse engineered versions of this library available. It warms my heart that so many in the community have been so dedicated to make this happen. ❤️ For the time being, I'm pulling all these different approaches into separate branches of this repository so we as a community can evaluate them all. (I should get to adding a branch for you in the next 24 hours). Note that it's very important that we license these various efforts under the AGPLv3. There are a lot of reasons for this. Most notably, we don't want Bambu to be able to take this code and incorporate it into a reimplemented slicer that is **not** governed by AGPLv3 at all. Right now, we have a huge benefit that [the Bambu networking libraries are *themselves* governed by AGPLv3](https://sfconservancy.org/blog/2026/may/17/incomplete-corresponding-source-code-copyleft-agpl/#object-code-also-copylefted), and we don't want to give up that benefit by offering up a non-copylefted reimplementation. Finally, since what you're saying is that you're offering up to the project something that we can treat as clean room, you're indicating that you did use the binary to help you with the task to give us this. As such, your work **has** to be licensed AGPL *because* it's impossible for it to not be a “covered work” under AGPLv3. For those reasons (and others), I'm going to mirror your branches onto here and apply the AGPL3 to them. (It's easily done, since the MIT license is fully compatible with relicensing under the AGPLv3 in any event.) Thank you again so much for this work!

👍 1

bkuhn added the due date 2026-05-21

2026-05-20 18:31:34 +00:00

bkuhn referenced this issue

2026-05-20 22:51:57 +00:00

rust implementation WIP #2

bkuhn self-assigned this

2026-05-20 22:52:53 +00:00

davidarthurcole commented

2026-05-21 16:08:36 +00:00

Member

Hi @Frix_x - wondering if you could take a look over #3 - I've got my own attempt at a workspace decomp setup, and would love a cross-examination. I'm looking over your approach and see a lot of similarities, but also some key differences. :)

lazerusrm commented

2026-05-26 21:19:22 +00:00

Member

Hey guys, just FYI i have built a replacement plugin, its getting close. I can authenticate with it and do most/all cloud functions and MQTT / LAN things (WITHOUT Dev mode), still testing/iterating but you can check my repo, hopefully will have it working with orcaslicer all the way soon.

Rows
Columns

clean-room documentation of bambu_networking.dll ready for review #1