Abstract:
Modern 3D-Printing workflows use slicer project files, pre-sliced G-Code, and online model-sharing platforms to distribute printable models. Besides printer settings, slicer project files can contain custom G-Code, which can directly control movements, temperatures, and other printer functions. This thesis investigates whether shared project files and G-Code files can serve as delivery vectors for malicious G-Code.
To achieve this, the internal structures of 3MF files created by Ultimaker Cura, PrusaSlicer, Bambu Studio, and OrcaSlicer are examined, and proof-of-concept files containing custom G-Code are tested across each slicer. The analysis evaluates retention, filtering, persistence, and user disclosure of embedded instructions. Furthermore, the handling of project files and pre-sliced G-Code by Thingiverse, Printables, and MakerWorld is evaluated. A public Thingiverse corpus of project and G-Code files is additionally analyzed using regular-expression-based detection, Slicer-config-parsing, extreme-parameter checks, and manual review of selected candidates.
All tested slicers incorporate embedded custom G-Code into newly generated output for the tested project-file locations. General command-based filtering was not observed, and warnings for invalid movements did not generally prevent G-Code export. Disclosure varies substantially: Bambu Studio provides explicit warnings for some modified G-Code fields, whereas Cura does not clearly disclose embedded instructions and retains imported settings across restarts. None of the tested platforms remove embedded custom G-Code reliably from project files before distribution. No explicitly malicious G-Code was identified in the analyzed corpus; however, this does not establish that malicious files are absent, since their identification depends on printer-specific execution context. The results show that shared project files and pre-sliced G-Code constitute practical delivery vectors for externally supplied instructions and underline the need for clearer security indicators and safer handling of untrusted print configurations.