H2D update URL sniffing

Hey there

I would like to check if offline update works with H2D (they claim that it doesn’t work right now, but in the menu you can find offline update section, so i want to check it out)
My printer is region locked, so i cant do it myself and i still would like to try update it offline, so can anybody get the update link if possible?

It should look like this:

Thanks in advance

How do you know about the region lock ?

All chinese models are region locked, i cant bind my acc without Chinese number

I assume the traffic is https, and so the endpoint is probably encrypted. May be able to get the IP or plaintext site, but not the path. Trust me, I was curious of the same thing.

Thanks for the reply.

There’s one Korean guy who forced update through MQTT, he has guide for all printers except H2D, somehow he got the link. I tried to check through different MQTT requests (i thought maybe link could be hardcoded) but still no luck. So im waiting for his reply.

I seems to found a way to do this, but i need someone with global version of H2D with a latest update, it’s just one simple MQTT command, if someone could help me with that, whole chinese owned printer community would be grateful to you

My printer is region locked, so can you share his link?

I’ve tried this method and it doesn’t work, apparently Bambu decided to remove firmware history from MQTT which means that you can’t get link anymore, but if you are curious here’s the link of that post.

And here’s command i asked to run one man who has a global version.

I’m facing the same issue—I unknowingly bought the China version without realizing it was region-locked. I tried to find a VPN with a China Mainland IP, but had no luck. Most VPN providers only offer servers in Hong Kong, not in Mainland China.

You can only upgrade via USB drive now I think

HTTPS only encrypts the content, not the URL.

You can certainly get the endpoint URL if they’re using HTTPS.

For example, even if you use HTTPS, your ISP can still see what websites you visit if they want to.

TL;DR it’s entirely possible to see the endpoint URL regardless of HTTPS/SSL.

Yes, but i think i found another way of getting url address of the firmware using GET requests as described in OpenBambu github.

If the software is open source [I haven’t looked, tbh] then yeah - diving through the code would show it.

But so would firing up WireShark in promiscuous mode and watching the traffic - or having a router that allows you to capture/investigate traffic. Honestly there are a LOT of ways to figure it out.

Now there are ways for them to ‘lock it down’ so that even if you had the URL, you couldn’t get the file, but I suspect that’s not the case.

It’s very easy to obfuscate the url with smart use of CDN. Anyone can do it in a minute.

Ehhh. For what it’s worth - I’ve been in the ISP / web hosting / CDN field as a systems administrator for 20 years.

Obfuscation is just that - obfuscation. Ultimately if the files are available to download - it’s possible to do so even if you have to jump through some hoops.

they can make the url only be available for example 5 minutes, what are you going to do about that? sure you can get the package yourself but that means you’re responsible of sharing that firmware pack afterwards

If they are distributing new firmware to their printers, I’m not sure why they would only make it available for 5 minutes.

What would be much more likely is that they require a PSK to download the file. A PSK would be shared over SSL and encrypted - but if the software is open source - it may contain the PSK… but they could always strip it.

Realistically - I don’t think there’s any obfuscation or anything funny going on - just that they aren’t publishing the URL to the package so you have to find it yourself.

it’s very common practice for blob storage with cloud or cdn

Having a short TTL isn’t unusual, sure, but if you are distributing software to your devices you generally don’t want the software to disappear after 5 minutes.

Hi!Were you able to solve this problem?