| Firmware base & current version (Klipper fork / Marlin fork / proprietary) | Klipper-derived, proprietary vendor UI/app on top. Host klippy is a Klipper ~0.11-era fork; MCU firmware is a Klipper-11 build labelled 2.2.3, unchanged since Jan 2024. Latest version on FlashForge's own release-notes page: 3.1.9-2.2.3-20250807. Actual shipping firmware is far newer: Z-Mod's native-firmware index lists AD5M stock builds up to 5.1.1 (2026-04-17), and Forge-X byte-analysed series images up to 5.1.7 (2026-06-05) pulled from FlashForge's own OTA source. Linux kernel: 5.4.61, byte-identical across stock firmware 2.6.5 → 5.1.x. | 1 source |
|---|
| Source code availability (repos, GPL compliance status, last update date) | Partial compliance. FlashForge published one GPL repo for this printer: FlashForge/AD5M_Series_Klipper (GPL-3.0, Klipper 0.11.0-era, last push 2024-05-09, 81★). Its entire GitHub org is 3 repos (that one + OrcaSlicer + Orca-Flashforge). No Linux kernel, U-Boot, Buildroot or rootfs sources are published despite shipping a GPL/GPLv2 Linux 5.4.61 system — the community has to pull the matching kernel source from a third-party mirror of the Allwinner T113 vendor BSP (github.com/iLotusK9/linux_kernel_aw_t113, branch 5.4.61) to build anything against it. The published Klipper also appears not to correspond to shipped binaries. | 1 source |
|---|
| Root/SSH access: possible? official or community method | Possible, community-only. Two documented routes: (a) flash Z-Mod's Adventurer5M-root.tgz via USB → SSH root/root; (b) g992's method: edit flashforge_init.sh inside a firmware update archive to add a user + overwrite /etc/passwd with uid 0, then connect by telnet on port 23. | 1 source |
|---|
| Moonraker / Mainsail / Fluidd or other open API available (stock vs after mods)? | Stock: none. No Moonraker, no web UI, no documented open HTTP API. All three mods add Moonraker (7125) + Mainsail + Fluidd. | 1 source- g992 software/readme.md: "we have not moonraker :("; printer-hub ("ships with Klipper-based firmware without web interface"); firmware/flashforge_ad5m_klipper_mod/README. · 2026-08 · local
|
|---|
| Notable community firmware/mods (names, repos, what they add) | Xblax/flashforge_ad5m_klipper_mod (433★, GPL-3.0, Buildroot rootfs + upstream Klipper 0.13 + MCU reflash, full init hijack); ghzserg/zmod "Z-Mod" (418★, Apache-2.0, keeps stock Klipper, adds KAMP/PID/IS/belt spectrogram/Telegram/plugins/GuppyScreen/HelixScreen, zmod.link remote access); DrA1ex/ff5m "Forge-X" v1.4.1 (396★, GPL-3.0, extends the Z-Mod lineage, resurrection.py power-loss plugin, Feather UI, ZRAM swap, real-time Klipper scheduling) | 1 source- GitHub API repo stats (fetched 2026-08-19); evidence/zmod_readme.md; firmware/ff5m/README.md, version.txt, docs/MOD_COMPARISON.md; firmware/flashforge_ad5m_klipper_mod/RE · 2026-08 · local
|
|---|
| Firmware update mechanism (OTA/USB) & update cadence history | OTA over WiFi (Settings → Firmware update) and USB stick (FAT32, vendor.tgz, no signature check). FlashForge's public changelog lists exactly 17 releases, re-extracted verbatim by curl + regex on 2026-08-19: 2.3.6-2.1.9-20231101, 2.3.7-2.1.9-20231110, 2.4.2-2.1.9-20231201, 2.4.5-2.2.3-20240118, 2.6.5-2.2.3-20240411, 2.6.6-2.2.3-20240428, 2.7.1-2.2.3-20240606, 2.7.2-2.2.3-20240705, 2.7.3-2.2.3-20240829, 2.7.5-2.2.3-20240911, 2.7.6-2.2.3-20241028, 2.7.7-2.2.3-20241122, 2.7.8-2.2.3-20241213, 2.7.9-2.2.3-20241228, 3.1.3-2.2.3-20250107, 3.1.5-2.2.3-20250212, 3.1.9-2.2.3-20250807. At least 6 further AD5M releases shipped but were never published there: 3.2.3 (2025-10-16), 3.2.5 (2025-12-05), 3.2.6 (2025-12-12), 3.2.7 (2025-12-17), 5.0.3 (2026-01-22), 5.1.1 (2026-04-17); series images run to 5.1.7 (2026-06-05). | 1 source |
|---|
| G-code flavor & notable custom G-codes/macros | Klipper flavour (gcode_flavor: klipper in FlashForge's own Orca profile). Notable: M900 K<val> → SET_PRESSURE_ADVANCE (Marlin linear-advance shim, in the stock config); M25 pause; M106 P2; [gcode_arcs] resolution: 1 (G2/G3); [exclude_object] added in firmware 2.6.5; M300/M356 beeper macros only via Z-Mod | 1 source- stock printer.base.cfg L284-295; firmware/orca_flashforge_profiles/fdm_adventurer5m_common.json ("gcode_flavor": "klipper", emit_machine_limits_to_gcode: 1); FlashForge w · 2026-08 · local
|
|---|
| Root shell: exact method (official setting toggle / vendor-documented / community exploit / none). Is root persistent across OTA firmware updates, or wiped each update? | Community exploit only — no official toggle, no vendor-documented method — but substantially more durable than an earlier draft of this row claimed. Method: write a vendor-format.tgz update archive to a FAT32 USB stick (Adventurer5M-root.tgz, or a hand-edited flashforge_init.sh in any update archive), boot, log in as root. The vendor installer still performs no signature or integrity verification, verified by byte-comparison through stock 5.1.7 (2026-06-05), so the exploit is not a patched hole — it is the permanent shape of FlashForge's update system. Persistence: partial, and predictable. An OTA reverts /etc/shadow and /etc/inittab in the stock rootfs — so a bare rootfs-level root hack is wiped. It does not touch /data (mmcblk0p7), where all three mods live, and it does not touch /opt/klipper. Forge-X states plainly that a stock OTA, including a 3.x → 5.x jump, leaves the mod running. | 1 source- firmware/ff5m/docs/FIRMWARE_5x_COMPAT.md — verbatim: "an OTA flash reverts /etc/shadow and /etc/inittab to stock. This is identical to 3.x behavior and does not affect Fo · 2026-08 · local
|
|---|
| Userland: OS base (Debian/Ubuntu/Buildroot/OpenWrt/busybox-only), package manager present (`apt`/`opkg`/`ipkg`/none), CPU architecture (armv7 / aarch64 / mips / x86), and free space on the writable partition. A busybox/no-apt rootfs with a few MB free is a red flag — say so. | Stock: vendor Buildroot-style appliance rootfs, BusyBox userland, no system package manager, telnet-capable, /data = mmcblk0p7. Mods: a second Buildroot rootfs in a chroot on /data (xblax /data/.klipper_mod; Forge-X /data/.mod/.forge-x). No apt, opkg, apk or systemd anywhere — but the xblax chroot does ship python3 + pip, plus target binutils. Kernel: Linux 5.4.61 (vermagic=5.4.61 SMP preempt mod_unload ARMv7 p2v8), Allwinner T113 (sun8iw20) vendor BSP, byte-identical across stock firmware 2.6.5 → 5.1.x. Arch: armv7 32-bit hard-float, Cortex-A7, NEON-VFPv4, glibc (arm-buildroot-linux-gnueabihf). RAM: 128 MB total, ~110 MB usable. Storage: 8 GB eMMC; install requires ≥128 MB free on / and ≥512 MB free on /data. Networking userland is genuinely complete: iptables, iproute2, dropbear, ca-certificates, socat, tcpdump, netcat, curl, rsync, git, nfs-utils, vim/nano/screen. /proc/config.gz is present on the stock kernel. | 1 source- firmware/flashforge_ad5m_klipper_mod/docs/LINUX.md: "Klipper Mod is not a conventional Linux distribution… you won't find a package manager or systemd"; "Be aware of the · 2026-08 · local
|
|---|
| Native Tailscale feasibility: can `tailscaled` run persistently on-device? Cite concrete evidence — community guides, wiki entries, forum posts, or repos of people actually doing it on THIS model. Note whether it needs `/dev/net/tun` (kernel TUN support) and whether the kernel provides it, plus whether userspace-networking mode is the only option. Distinguish "someone did it" from "should theoretically work." | STILL NOT DEMONSTRATED — nobody has published running tailscaled on an AD5M — but the technical path is far better established than an earlier draft of this row concluded. Negative evidence (re-run independently): all three mod repos grep clean for tailscale/wireguard/tun.ko/net/tun; GitHub issue search on all three repos → total_count: 0; fresh 2026-08-19 web searches surface only generic Tailscale-with-Klipper-on-a-Pi advice, nothing on this model. (1) the stock kernel exposes /proc/config.gz, so CONFIG_TUN is a *one-command check* on any rooted unit — it is unpublished, not unknowable; (2) the exact vendor kernel source is public (Allwinner T113 / sun8iw20, branch 5.4.61) and Forge-X publishes a complete, reproducible recipe for building vermagic-exact out-of-tree modules against the stock kernel — and ships two of them (zram.ko, zsmalloc.ko) that the printer insmods at boot; (3) the kernel is byte-identical from firmware 2.6.5 to 5.1.x, so such a module is built once and never rebuilt; (4) iptables and iproute2 are already in the mod chroot (N9). So if TUN is not compiled in, tun.ko is buildable by an established, documented, already-exercised method. | 1 source- Negative evidence, re-verified independently 2026-08-19: grep -ril 'tailscale' firmware/ff5m firmware/flashforge_ad5m_klipper_mod → none; `grep -rn 'net/tun\ · 2026-08 · local
|
|---|
| SSH daemon: present by default or must be installed/enabled? Default credentials if documented. Does an OTA update disable it or reset the password? | Not present/enabled on stock as shipped. The stock exploit path uses telnet on port 23, not SSH. Mods install Dropbear (not OpenSSH) — confirmed in xblax's Buildroot config, and consistent with the documented host-key behaviour. Credentials: Z-Mod root image root / root; xblax root / klipper (set at build time: BR2_TARGET_GENERIC_ROOT_PASSWD="klipper"); Forge-X root / root. The stock rootfs does carry a real root entry — root:$1$OnclaLQR$TyysbY8rO.awyp7JldE9K. — byte-identical across every stock firmware from 3.1.3 to 5.1.7, so an OTA restores that hash but never rotates it. Separately, the printer's own settings file contains a web-console credential pair admin / ff123456. Documented failure modes: mods use different SSH host keys, so switching mods triggers host-key mismatches, and "Resource constraints may prevent the SSH service from running". | 1 source |
|---|
| Filesystem persistence: is the rootfs read-only or overlay-mounted? Do user-installed binaries and init/systemd services survive reboot and survive firmware updates? Is there a supported place to persist customizations? | Stock rootfs is a separate, vendor-owned partition; user customisation lives on /data (mmcblk0p7), and it is read-write and durable. xblax bind-mounts the stock / into its chroot at /mnt/orig_root remounted read-only (escape hatch: the jailbreak command drops you into the host environment). Mod rootfs + config + gcodes + Moonraker DB all live under /data, so they survive reboot and survive vendor OTA updates too, including a 3.x → 5.x jump. Init integration is via vendor-init hooks that live in the stock rootfs (/etc/inittab), which an OTA *does* revert; both mods therefore carry explicit re-hook/OTA-state logic. Supported persistence points: /data/.klipper_mod (xblax), /data/.mod/.forge-x + /opt/config/mod_data + mod_data/user.cfg + mod_data/user.moonraker.conf (Forge-X). | 1 source- firmware/flashforge_ad5m_klipper_mod/docs/LINUX.md ("The host system is mounted read-only to /mnt/orig_root. The printer data partition is mounted to /mnt/data… The mod s · 2026-08 · local
|
|---|