Wilson Fan
← Notes

Bambu Lab NFC Cloning

Writing a Bambu Lab filament spool's RFID data onto a fresh ISO14443A Gen2 tag with a Proxmark3, so a refilled or third-party spool reads as the real thing in the AMS.

Last updated

Line drawing of a handheld RFID reader scanning a coin-shaped tag

Every Bambu Lab spool has a Mifare 13.56 MHz tag glued to it, and the AMS reads it to identify material, color, and remaining length. Clone that tag onto a new card and glue it to a refilled spool (or a compatible third-party one) and the AMS treats it exactly like genuine Bambu filament.

Background

Two community projects do the heavy lifting here:

  • The RFID Tag Guide covers how the tags actually work: each tag carries several encrypted data blocks (material, color, manufacturing date) plus a 2048-bit RSA signature that authenticates all of it — change one byte anywhere and the signature fails, so a clone has to be an exact copy, block for block. The keys used to be extracted by sniffing a real tag, but they can now be derived straight from the tag's UID with a key-derivation function (deriveKeys.py), or pulled via a 2024 backdoor (script run fm11rf08s_recovery) if your Proxmark3 firmware supports it.
  • The Bambu Lab RFID Library is a crowd-sourced collection of already-dumped tags, organized by material → color → UID. If someone's already scanned the same batch of filament you have, you can skip reading your own tag entirely and just grab their dump and key.

What you need

  • A Proxmark3 running the Iceman firmware (v4.18994 or newer).
  • Blank ISO14443A Gen2 ("magic") Mifare Classic 1K tags — the UID has to be rewritable to match the original exactly, which stock tags don't allow. Gen1 magic tags don't work for this; Gen3/4 are untested.
  • A dump (.bin) and key file (.bin) for your filament, either from the RFID Library above or read off your own spool.

Steps

  1. Find your filament's dump and key in the RFID Library (or dump your own tag with the Proxmark3 first) — e.g. PLA/PLA Basic/Orange/0308501C/hf-mf-0308501C-dump.bin.
  2. Copy both files somewhere convenient, e.g. /tmp/bambu/0308501C/.
  3. In the Proxmark3 client, write the dump onto a Gen2 tag:
hf mf restore --force -f "/tmp/bambu/0308501C/hf-mf-0308501C-dump.bin" -k "/tmp/bambu/0308501C/hf-mf-0308501C-key.bin"

The --force flag is what lets the Proxmark3 overwrite block 0 (the UID) on a Gen2 tag — without it, the write only touches the data blocks and the UID stays mismatched, which fails the signature check.

Once it's written, tap the tag against the Proxmark3 and run hf mf info to confirm the UID and data match the original dump before gluing it to a spool.