fetch_credentials.py

@@ -0,0 +1,345 @@
+#!/usr/bin/env python3
+"""
+Decrypt printer configuration data using AES-256-CBC
+
+This script decrypts encrypted printer configuration data from a 3D printer using AES-256-CBC. 
+The method was reverse engineered from the vue project embedded in libWorkbench.so, 
+which is part of Anycubic Slicer Next. 
+The decryption key is derived from the device token, 
+and the IV is obtained from the response token in the encrypted data.
+
+- Algorithm: AES-256-CBC
+- Key: Characters 16-32 of the token from info.json
+- IV: The response token from ctrl.json
+- Mode: CBC with PKCS7 padding
+
+Usage:
+    python3 fetch_credentials.py --ip 192.168.2.32
+    python3 fetch_credentials.py --ip 192.168.2.32 --port 18910
+    python3 fetch_credentials.py --ctrl ctrl.json --info info.json --output config.json
+"""
+
+import json
+import sys
+import base64
+import hashlib
+import argparse
+import time
+import random
+import string
+import requests
+from pathlib import Path
+from Crypto.Cipher import AES
+from Crypto.Util.Padding import unpad
+
+
+def evp_bytes_to_key(password, salt, key_len, iv_len):
+    """
+    Derive key and IV from password and salt using OpenSSL EVP_BytesToKey
+    This mimics the CryptoJS default key derivation
+    """
+    m = []
+    i = 0
+    while len(b''.join(m)) < (key_len + iv_len):
+        md5 = hashlib.md5()
+        data = password + salt
+        if i > 0:
+            data = m[i - 1] + password + salt
+        md5.update(data)
+        m.append(md5.digest())
+        i += 1
+    ms = b''.join(m)
+    return ms[:key_len], ms[key_len:key_len + iv_len]
+
+
+def generate_signature(token, ts, nonce):
+    """
+    Generate MD5 signature for /ctrl endpoint
+    Signature = md5(md5(token[0:16]) + ts + nonce)
+    """
+    # First MD5: token.slice(0, 16)
+    first_md5 = hashlib.md5(token[:16].encode('utf-8')).hexdigest()
+    # Second MD5: first_md5 + ts + nonce
+    signature_data = first_md5 + str(ts) + nonce
+    signature = hashlib.md5(signature_data.encode('utf-8')).hexdigest()
+    return signature
+
+
+def generate_nonce(length=6):
+    """Generate a random alphanumeric nonce"""
+    chars = string.ascii_letters + string.digits
+    return ''.join(random.choice(chars) for _ in range(length))
+
+
+def fetch_from_http(ip, port, endpoint, token=None, did="random", verbose=False):
+    """
+    Fetch data from HTTP endpoint on the printer
+    
+    Args:
+        ip (str): IP address of the printer
+        port (int): Port number (default 18910)
+        endpoint (str): Either 'info' or 'ctrl'
+        token (str): Device token (required for /ctrl endpoint)
+        did (str): Device ID (required for /ctrl endpoint)
+        verbose (bool): Print debug information
+    
+    Returns:
+        dict: JSON response data
+    """
+    try:
+        if endpoint == 'info':
+            url = f"http://{ip}:{port}/info"
+            if verbose:
+                print(f"Fetching: {url}")
+            response = requests.get(url, timeout=10)
+            response.raise_for_status()
+            return response.json()
+        
+        elif endpoint == 'ctrl':
+            if not token:
+                raise ValueError("Token is required for /ctrl endpoint")
+            
+            # Generate signature parameters
+            ts = int(time.time() * 1000)  # Current timestamp in ms
+            nonce = generate_nonce(6)
+            signature = generate_signature(token, ts, nonce)
+            
+            url = f"http://{ip}:{port}/ctrl"
+            params = {
+                'ts': ts,
+                'nonce': nonce,
+                'sign': signature,
+                'did': did
+            }
+            
+            if verbose:
+                print(f"Fetching: {url}")
+                print(f"  Parameters:")
+                print(f"    ts: {ts}")
+                print(f"    nonce: {nonce}")
+                print(f"    sign: {signature}")
+                print(f"    did: {did}")
+            
+            response = requests.post(url, params=params, timeout=10)
+            response.raise_for_status()
+            return response.json()
+        
+        else:
+            raise ValueError(f"Unknown endpoint: {endpoint}")
+    
+    except requests.exceptions.RequestException as e:
+        raise Exception(f"HTTP request failed for {endpoint}: {e}")
+    except json.JSONDecodeError as e:
+        raise Exception(f"Invalid JSON response from {endpoint}: {e}")
+
+
+def decrypt_text(encrypted_data, key, iv):
+    """
+    Decrypt data using AES-256-CBC
+    Handles CryptoJS-style encrypted data (OpenSSL format with salt)
+    
+    Args:
+        encrypted_data (str): Encrypted data string (CryptoJS format)
+        key (str): Decryption key string
+        iv (str): Initialization vector string
+    
+    Returns:
+        dict: Decrypted JSON data
+    """
+    try:
+        # Convert key and IV to bytes
+        key_bytes = key.encode('utf-8')
+        iv_bytes = iv.encode('utf-8')
+        
+        # Decrypt using direct key and IV (as per the original code)
+        cipher = AES.new(key_bytes, AES.MODE_CBC, iv_bytes)
+        
+        # The encrypted_data might be base64 or hex encoded
+        # Try base64 first
+        try:
+            encrypted_bytes = base64.b64decode(encrypted_data)
+        except:
+            try:
+                # Try as hex
+                encrypted_bytes = bytes.fromhex(encrypted_data)
+            except:
+                # If all else fails, encode as UTF-8
+                encrypted_bytes = encrypted_data.encode('utf-8')
+        
+        # Decrypt
+        decrypted = cipher.decrypt(encrypted_bytes)
+        
+        # Try to unpad
+        try:
+            unpadded = unpad(decrypted, AES.block_size)
+        except ValueError:
+            # If unpadding fails, use as-is
+            unpadded = decrypted
+        
+        plaintext = unpadded.decode('utf-8')
+        
+        # Parse JSON
+        return json.loads(plaintext)
+    
+    except Exception as e:
+        return {"error": str(e), "error_type": type(e).__name__}
+
+
+def main():
+    """Main function to decrypt printer data"""
+    
+    # Parse command-line arguments
+    parser = argparse.ArgumentParser(
+        description='Decrypt Anycubic printer configuration data',
+    )
+    # HTTP mode
+    parser.add_argument('--ip', help='IP address of the printer (fetch via HTTP)')
+    parser.add_argument('--port', type=int, default=18910, help='Printer port (default: 18910)')
+    
+    # File mode
+    parser.add_argument('--ctrl', default='ctrl.json', help='Path to ctrl.json (default: ctrl.json)')
+    parser.add_argument('--info', default='info.json', help='Path to info.json (default: info.json)')
+    parser.add_argument('--output', default='decrypted_printer_config.json', help='Output file (default: decrypted_printer_config.json)')
+    parser.add_argument('--verbose', '-v', action='store_true', help='Verbose output')
+    
+    args = parser.parse_args()
+    
+    # Determine mode: HTTP or file
+    if args.ip:
+        # HTTP mode: fetch from printer
+        if args.verbose:
+            print("=" * 70)
+            print("Fetching configuration from printer via HTTP")
+            print("=" * 70)
+            print(f"Printer IP: {args.ip}:{args.port}")
+            print()
+        
+        try:
+            # Fetch info.json
+            if args.verbose:
+                print("Step 1: Fetching device info...")
+            info = fetch_from_http(args.ip, args.port, 'info', verbose=args.verbose)
+            
+            # Get token from info
+            token = info.get('token')
+            if not token:
+                print("Error: No token found in /info response", file=sys.stderr)
+                return 1
+            
+            # Fetch data.json (encrypted config) from /ctrl endpoint
+            if args.verbose:
+                print("\nStep 2: Fetching encrypted configuration from /ctrl...")
+            data = fetch_from_http(args.ip, args.port, 'ctrl', token=token, verbose=args.verbose)
+            
+            if args.verbose:
+                print("\nData fetched successfully!")
+            
+        except Exception as e:
+            print(f"Error: {e}", file=sys.stderr)
+            return 1
+    
+    else:
+        # File mode: load from disk
+        if args.verbose:
+            print("=" * 70)
+            print("Loading configuration from files")
+            print("=" * 70)
+        
+        # Check if input files exist
+        if not Path(args.ctrl).exists():
+            print(f"Error: {args.ctrl} not found", file=sys.stderr)
+            return 1
+        if not Path(args.info).exists():
+            print(f"Error: {args.info} not found", file=sys.stderr)
+            return 1
+        
+        # Read data.json
+        try:
+            with open(args.data, 'r') as f:
+                data = json.load(f)
+        except json.JSONDecodeError as e:
+            print(f"Error reading {args.data}: {e}", file=sys.stderr)
+            return 1
+        except Exception as e:
+            print(f"Error reading {args.data}: {e}", file=sys.stderr)
+            return 1
+        
+        # Read info.json
+        try:
+            with open(args.info, 'r') as f:
+                info = json.load(f)
+        except json.JSONDecodeError as e:
+            print(f"Error reading {args.info}: {e}", file=sys.stderr)
+            return 1
+        except Exception as e:
+            print(f"Error reading {args.info}: {e}", file=sys.stderr)
+            return 1
+    
+    # Extract values
+    try:
+        encrypted_info = data['data']['info']
+        response_token = data['data']['token']
+        full_token = info['token']
+    except KeyError as e:
+        print(f"Error: Missing required key {e}", file=sys.stderr)
+        return 1
+    
+    # Generate decryption key and IV
+    key_part = full_token[16:32]
+    
+    if args.verbose:
+        print("=" * 70)
+        print("Printer Configuration Decryption")
+        print("=" * 70)
+        print(f"Input data file: {args.ctrl}")
+        print(f"Input info file: {args.info}")
+        print(f"Output file: {args.output}")
+        print()
+        print("Decryption Parameters:")
+        print(f"  Encrypted data length: {len(encrypted_info)} bytes")
+        print(f"  Full token: {full_token}")
+        print(f"  Full token length: {len(full_token)} characters")
+        print(f"  Response token (IV): {response_token}")
+        print(f"  Decryption key: {key_part}")
+        print(f"  Key length: {len(key_part)} characters")
+        print(f"  IV length: {len(response_token)} characters")
+        print()
+    
+    # Decrypt
+    if args.verbose:
+        print("Decrypting...")
+    
+    result = decrypt_text(encrypted_info, key_part, response_token)
+    
+    if 'error' in result:
+        print(f"Error during decryption: {result.get('error')}", file=sys.stderr)
+        return 1
+    
+    # Pretty print result
+    if args.verbose:
+        print("=" * 70)
+        print("Decrypted Configuration:")
+        print("=" * 70)
+        print(json.dumps(result, indent=2))
+        print()
+    
+    # Save to file
+    try:
+        with open(args.output, 'w') as f:
+            json.dump(result, f, indent=2)
+        
+        if args.verbose:
+            print("=" * 70)
+            print(f"Successfully saved decrypted config to: {args.output}")
+            print("=" * 70)
+        else:
+            print(f"Decrypted config saved to: {args.output}")
+    except Exception as e:
+        print(f"Error writing to {args.output}: {e}", file=sys.stderr)
+        return 1
+    
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())

requirements.txt

@@ -1,2 +1,4 @@
 aiohttp>=3.9
 imageio-ffmpeg>=0.4.9
+requests>=2.30.0
+pycryptodome>=3.20.0