bambu-connect
- latest exe: https://public-cdn.bblmw.com/upgrade/bambu-connect/bambu-connect-beta-win32-x64-v1.0.4_4bb9cf0.exe
- extracts into
%LOCALAPPDATA%\bambu_connect
- electron app 😮💨
- generates 100 1gb files to be annoying (asarmor?):
- asarmor confirmed from windows build:
C:\Users\ci.slave\zadig\bambu-connect\windows\291\windows-windows-default\bambu-connect\node_modules\asarmor\build\Release\main.pdb; len=132
malasarkey
- many garbage files, but the relevant ones:
/.vite/build/main.js /.vite/build/main.node /.vite/build/preload.js
- asarmor decrypt process includes
GetKey
/GetKeyArray
as per asarmor main.cpp - decryption key located inmain.node
file. - obfuscated heavily in the windows version, not so much in the macos version:
- rizin -> string search ->
GetKey()
:
b0ae6995063c191d2b404637fbc193ae10dab86a6bc1b1de67b5aee6e03018a2 ; lol. lmao even.
- rizin -> string search ->
- can use asarfix to extract the files from the .asar with that key:
- files in
unpack/.vite/
:main.js
-> our targetpreload.js
- irrelevant
current
values are rc4-encrypted, key(s) obviously in the code. function lt()
and co. handles decryption:
// snipped for readability.
- api key (rc4 key:
1o9B
):GLOF3813734089-524a37c80000c6a6a274a47b3281
- certificate (rc4 key:
NPub
):-----BEGIN CERTIFICATE----- MIIDeTCCAmGgAwIBAgIUGpX26HEycYnaaCUFwJr8F/UPCZIwDQYJKoZIhvcNAQEL BQAwKDEmMCQGA1UEAwwdYXBwbGljYXRpb25fcm9vdC5iYW1idWxhYi5jb20wHhcN MjQwNzI2MDE1MjI3WhcNMzQwNzI0MDE1MjI3WjAfMR0wGwYDVQQDDBRzZXJ2aWNl LmJhbWJ1bGFiLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ2z wQvNAjA9lQe06o/Vv6JULHLn25NK706myDa4i9lmb3wqARNVi6aSWfxO3Cz9NklC 4dYAdFbgcEUXuJIcJBBZdgPO2GhnaeCUVWz/ucW2GCdPaBAkXZNDK56aPqfYwltI sNJcUIvq0OmbFsI90l8zKTQzd8/zJcfm8lOBpAberwbEeHCQfDxUWpNyrAuGJlkD cmxraAjzBXQjAyMT+kK+KPOqhJICu5SXP87WGlzw8sfrdLl7J2vhtXpzRC67vtv6 uD6aqq5f2OaRxHRUyqeDY/adiWE9Qeb9amkRMcQiUJ0IQJZ4wDSMNpZe0guXLkl5 LPdPU249Bu86H5eDf5ECAwEAAaOBozCBoDAJBgNVHRMEAjAAMAsGA1UdDwQEAwID uDAdBgNVHQ4EFgQUb/FHYnyT++aiAcbhmQsDIMw/C+kwZwYDVR0jBGAwXqFGpEQw QjELMAkGA1UEBhMCQ04xIjAgBgNVBAoMGUJCTCBUZWNobm9sb2dpZXMgQ28uLCBM dGQxDzANBgNVBAMMBkJCTCBDQYIUGpX26HEycYnaaCUFwJr8F/UPCYgwDQYJKoZI hvcNAQELBQADggEBAK3n3LsRPiT9dEKrteCvBhaO/nAhc3Ogpi5iw4yiSB6abIHy a36oGCA7RDMaMizDxbmWqooasA3xWnWLaf83FPt8KTnG72hmRb/usjc8sqFQQPPX /VZf8ITAILx7Nrh1yLKI31UtYLMgeGNA8sifQUVJFOLqcwEpqUvII5ZK1YZ/27lM gmscseUC5s4MTVf+aT5Gxg/v8MI0kgzNKCUELx7HuMfz/Og7+BSS58piZ1vt8Mgq VvhUVmCS9SnCnvkM57zOumHHlvoSf7u6eq7YQd6spdJBYS1Yf2KGxKG2uooT9VlX Gq8Fcpo0F9pzYXX3kKeBJo1vl1/R54eAgd82rNg= -----END CERTIFICATE-----
- private key (rc4 key:
Tlj0
):-----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDQNp2NfkajwcWH PIqosa08P1ZwETPr1veZCMqieQxWtYw97wp+JCxX4yBrBcAwid7o7PHI9KQVzPRM f0uXspaDUdSljrfJ/YwGEz7+GJz4+ml1UbWXBePyzXW1+N2hIGGn7BcNuA0v8rMY uvVgiIIQNjLErgGcCWmMHLwsMMQ7LNprUZZKsSNB4HaQDH7cQZmYBN/O45np6l+K VuLdzXdDpZcOM7bNO6smev822WPGDuKBo1iVfQbUe10X4dCNwkBR3QGpScVvg8gg tRYZDYue/qc4Xaj806RZPttknWfxdvfZgoOmAiwnyQ5K3+mzNYHgQZAOC2ydkK4J s+ZizK3lAgMBAAECggEAKwEcyXyrWmdLRQNcIDuSbD8ouzzSXIOp4BHQyH337nDQ 5nnY0PTns79VksU9TMktIS7PQZJF0brjOmmQU2SvcbAVG5y+mRmlMhwHhrPOuB4A ahrWRrsQubV1+n/MRttJUEWS/WJmVuDp3NHAnI+VTYPkOHs4GeJXynik5PutjAr3 tYmr3kaw0Wo/hYAXTKsI/R5aenC7jH8ZSyVcZ/j+bOSH5sT5/JY122AYmkQOFE7s JA0EfYJaJEwiuBWKOfRLQVEHhOFodUBZdGQcWeW3uFb88aYKN8QcKTO8/f6e4r8w QojgK3QMj1zmfS7xid6XCOVa17ary2hZHAEPnjcigQKBgQDQnm4TlbVTsM+CbFUS 1rOIJRzPdnH3Y7x3IcmVKZt81eNktsdu56A4U6NEkFQqk4tVTT4TYja/hwgXmm6w J+w0WwZd445Bxj8PmaEr6Z/NSMYbCsi8pRelKWmlIMwD2YhtY/1xXD37zpOgN8oQ ryTKZR2gljbPxdfhKS7YerLp2wKBgQD/gJt3Ds69j1gMDLnnPctjmhsPRXh7PQ0e E9lqgFkx/vNuCuyRs6ymic2rBZmkdlpjsTJFmz1bwOzIvSRoH6kp0Mfyo6why5kr upDf7zz+hlvaFewme8aDeV3ex9Wvt73D66nwAy5ABOgn+66vZJeo0Iq/tnCwK3a/ evTL9BOzPwKBgEUi7AnziEc3Bl4Lttnqa08INZcPgs9grzmv6dVUF6J0Y8qhxFAd 1Pw1w5raVfpSMU/QrGzSFKC+iFECLgKVCHOFYwPEgQWNRKLP4BjkcMAgiP63QTU7 ZS2oHsnJp7Ly6YKPK5Pg5O3JVSU4t+91i7TDc+EfRwTuZQ/KjSrS5u4XAoGBAP06 v9reSDVELuWyb0Yqzrxm7k7ScbjjJ28aCTAvCTguEaKNHS7DP2jHx5mrMT35N1j7 NHIcjFG2AnhqTf0M9CJHlQR9B4tvON5ISHJJsNAq5jpd4/G4V2XTEiBNOxKvL1tQ 5NrGrD4zHs0R+25GarGcDwg3j7RrP4REHv9NZ4ENAoGAY7Nuz6xKu2XUwuZtJP7O kjsoDS7bjP95ddrtsRq5vcVjJ04avnjsr+Se9WDA//t7+eSeHjm5eXD7u0NtdqZo WtSm8pmWySOPXMn9QQmdzKHg1NOxer//f1KySVunX1vftTStjsZH7dRCtBEePcqg z5Av6MmEFDojtwTqvEZuhBM= -----END PRIVATE KEY-----
- certificate chain (rc4 key:
FT2A
):-----BEGIN CERTIFICATE----- MIIDXTCCAkWgAwIBAgIRAO48rAcSzurNqLf7xC50uiwwDQYJKoZIhvcNAQELBQAw JjEkMCIGA1UEAwwbR0xPRjM4MTM3MzQwODkuYmFtYnVsYWIuY29tMB4XDTI0MTIx MTA5MjkyMFoXDTI1MTIxMjA5MjkyMFowTDEkMCIGA1UEChMbR0xPRjM4MTM3MzQw ODktNTI0YTM3YzgwMDAwMSQwIgYDVQQDExtHTE9GMzgxMzczNDA4OS01MjRhMzdj ODAwMDAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDQNp2NfkajwcWH PIqosa08P1ZwETPr1veZCMqieQxWtYw97wp+JCxX4yBrBcAwid7o7PHI9KQVzPRM f0uXspaDUdSljrfJ/YwGEz7+GJz4+ml1UbWXBePyzXW1+N2hIGGn7BcNuA0v8rMY uvVgiIIQNjLErgGcCWmMHLwsMMQ7LNprUZZKsSNB4HaQDH7cQZmYBN/O45np6l+K VuLdzXdDpZcOM7bNO6smev822WPGDuKBo1iVfQbUe10X4dCNwkBR3QGpScVvg8gg tRYZDYue/qc4Xaj806RZPttknWfxdvfZgoOmAiwnyQ5K3+mzNYHgQZAOC2ydkK4J s+ZizK3lAgMBAAGjYDBeMA4GA1UdDwEB/wQEAwIDuDAMBgNVHRMBAf8EAjAAMB0G A1UdDgQWBBTbM6dbfGu7o6o1IU59QyDzMcexjzAfBgNVHSMEGDAWgBTCydEtLumS 2pknAxmjOizTHKwImzANBgkqhkiG9w0BAQsFAAOCAQEAmmD3Fu37vgw4qr/Dgr15 FSdoCuVAZPD7I5FwcBlPH98TJ0hNUtnDVxkJ0pde8ZcQdYFkfYFNnX+7f06ps/TY CtchEAlx9cXBfBnImO4mB2Y89uRh7HRA2BiUmme4Xjy5P3qyvOnx2lIiH2hFyXJ0 6N8UcBEviZTZd+D6FR5TJ8aNOhCwktutsrwKeSj4jrIWSD0vPlkQTbxUrm6x+7/i JBwOsMNA5UB+SZxAn8BtcvzpxHaj1l3WRddZcykTfz6k8fuQfJCdp1aN47guLXWt HTDvXeOlXpDStOlIwwMvh2i42ZaLas2C2B8rrX6pMmzazJLZcth8ZIyhfuB1WcMv AQ== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIDjDCCAnSgAwIBAgIUGpX26HEycYnaaCUFwJr8F/UPCZQwDQYJKoZIhvcNAQEL BQAwKDEmMCQGA1UEAwwdYXBwbGljYXRpb25fcm9vdC5iYW1idWxhYi5jb20wHhcN MjQwODAyMDkwNTIwWhcNMzQwNzMxMDkwNTIwWjAmMSQwIgYDVQQDDBtHTE9GMzgx MzczNDA4OS5iYW1idWxhYi5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK AoIBAQDNLcdi86lRDBbYOmXGEX2TiRSxDJUzXe/ruNmXCYKq/fkilTPt5SbtXItl bflG4FpdzaJoay3iXBRB93E7AHwugAHWHvBvg+X0SEpgHc4wJVevYU4Mruyhq80C SKURdpfFG4jLKHOe+s4Hos7glPB5cXcQ4O8rgRNP+S8UDS3PwoUcKKKNTkDVatb4 z+19AVxnwzxznL2scRcoyuOOjuzGlX1jdWE6uNey9TpO30DMsGLeDsn9oju0uKKl toeE0osKVpE/DKuvixUxFEGbL1oOb3OrNih1C0B/uwwhZo3H8G+afaEYUwUVF8m0 YVB1zSakL4vBLuIRabqpWh8aETCDAgMBAAGjga8wgawwEgYDVR0TAQH/BAgwBgEB /wIBATAOBgNVHQ8BAf8EBAMCAb4wHQYDVR0OBBYEFMLJ0S0u6ZLamScDGaM6LNMc rAibMGcGA1UdIwRgMF6hRqREMEIxCzAJBgNVBAYTAkNOMSIwIAYDVQQKDBlCQkwg VGVjaG5vbG9naWVzIENvLiwgTHRkMQ8wDQYDVQQDDAZCQkwgQ0GCFBqV9uhxMnGJ 2mglBcCa/Bf1DwmIMA0GCSqGSIb3DQEBCwUAA4IBAQApce6+U+HHCRkvcGeRwMcE Fvd8MBzxmQSoDBRA+dEoIQfWoE8eo5mWDKF+prklxnmm4MWemB95ACRfDC3jDrqh fNacLnX4jfhhBQI20OD1s9swvE1SCONGpNeyDjNOcDqHN/WCRh5XAc1MWcAH2enY q79XhTF+oVQits59yoIes5CWRxGU1uEchUzU/YLHqIcqEL1pcTd/hcMv7cmAt5QU uK5JOhq9lwHy723AZHrNTSPzWUeLCqC51ObpjFM03+icj1A9VFmS/3DOlZRv6B55 bwY7NtZI5p+B9Q14X0+z0fCjsU5yLtjOledFqHjqXh8jHdw1gOh7x4/j5m9Heaub -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIDHjCCAgagAwIBAgIUGpX26HEycYnaaCUFwJr8F/UPCYgwDQYJKoZIhvcNAQEL BQAwQjELMAkGA1UEBhMCQ04xIjAgBgNVBAoMGUJCTCBUZWNobm9sb2dpZXMgQ28u LCBMdGQxDzANBgNVBAMMBkJCTCBDQTAeFw0yNDA1MjkwMjU0NTdaFw0zNDA1Mjcw MjU0NTdaMCgxJjAkBgNVBAMMHWFwcGxpY2F0aW9uX3Jvb3QuYmFtYnVsYWIuY29t MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4dwG7fhJRGVQ1RTxthzv l6nEtHkNGj5c1Z81pDRCB8ZHj3kx2W+eMrvwvONIyTl5nErQz2YGCsqPVGqOao2s CLSxEkq2pEXgHnatlOd02/Z6msWBMSUEYUqg2A3uPgijmHFSbAZFf9/0tO21O7wm +ldfg9ZSdBKkRcJFK92dgfyXVXfyBzcTMDmOUCG8YyS+/tFBWPzlCgEJadzlFUmm ayZp5Msk+7CDEm60cUrWgiFfoIezsfcyDrI0S6Vhl0G3sbv886mjPbEZdnPmzGvU OTvFJeYvATbY2g43/as0pVguWd5hZJRTUcCvFUFZIOhtRxFLbwPt5ce0ASmtrOVC 2QIDAQABoyYwJDASBgNVHRMBAf8ECDAGAQH/AgECMA4GA1UdDwEB/wQEAwIBvjAN BgkqhkiG9w0BAQsFAAOCAQEAeq9eICO82sj4YKVqAlk/lDqFV0DgdrfzVJYwjJsD 4qvQzLhmdny3Q27yufztqCYQqy6VnoIw2kTHNYbvpCaU0lzZHjJPH3FX+MPL2wm4 /cKvAPQi+aGPcCmSJYmizNC4bGZ0O+7pFl9SZKRW9tehWUQYyAOaq4bK3hqHJchj nFEpgVBl6erlbAvOOXeuLvQvgpQAKLysz2AnfMx5/9HJzf9rlWCjgVplCJgvudT7 f7gnmmCFCz0KQY4AXmtmUinn+G/RTBU/YiWp7P92UcFHRs6NWOb11daHjl0lz1YO HwWFH7i/Q45bIcfftUW4IuF6aGQ7g0/ti8XEvXjXJhPzew== -----END CERTIFICATE-----
- certificate revocation list (crl) (rc4 key:
x077
):-----BEGIN X509 CRL----- MIIB6jCB0wIBATANBgkqhkiG9w0BAQsFADAmMSQwIgYDVQQDDBtHTE9GMzgxMzcz NDA4OS5iYW1idWxhYi5jb20XDTI0MTIyODAzNDkyMloXDTI1MDEyODA0NDkyMlow SDAiAhEAwKnG9y7waEObyjeMvq6AsRcNMjQxMjIwMDczODQ0WjAiAhEA8Nae8vkm xTtjKidwSnzKexcNMjQxMjE5MDgwMjQ1WqAvMC0wHwYDVR0jBBgwFoAUwsnRLS7p ktqZJwMZozos0xysCJswCgYDVR0UBAMCAXswDQYJKoZIhvcNAQELBQADggEBAIV+ jSqHblK7ZEH6eb8T7zFsFBPTrr4DKmwcBarCq9OLUtN/FSCcGXnVP6dWU06+RhE0 mSwh6ER6LDQEupYXpOerZPE0zGQOa5q/CsfTAtpBndMsKM9jKFTh0+Gr7V46fkuM kJ7UeO17FddDtfCDqxIvheo/RPvZPoiNuCpUQuGAI59O3kFqNkv6VsZlk+7E/D1Q aSiKr+bk6+hWslSLtenA4rxZNcL8cq7AYijLPlE2HTN6ASCMx/bBZXzm28KHDyeR FtfnJsmWXBbeOqHmR9/JpSbJdXRD6jvXF2nQVgQcAqv3DZcOhov0ah+31foAe2/e aRANWl5wMJ5nUd5UFCk= -----END X509 CRL-----
SERIAL: 0x00C0A9C6F72EF068439BCA378CBEAE80B1 REVOKED AT: 2024-12-20 07:38:44 REASON: Unspecified SERIAL: 0x00F0D69EF2F926C53B632A27704A7CCA7B REVOKED AT: 2024-12-19 08:02:45 REASON: Unspecified