Taking the Freedom, Then Locking the Door: GRBL, GPLv3, and the Genmitsu 3030-PROVer MAX
There is something particularly backwards about using open-source software to build a commercial product, withholding the source code that made the product possible, and then adding a hardware authentication system designed to control where that firmware will execute.
That is the situation now emerging from analysis of the firmware distributed for the Genmitsu 3030-PROVer MAX CNC controller.
The firmware publicly distributed by SainSmart identifies itself as:
Grbl 1.1f
GRBL 1.1f is licensed under the GNU General Public License version 3, GPLv3.
But the evidence no longer consists merely of a version banner.
Reproducible analysis of the firmware has identified correspondence with GRBL 1.1f across multiple internal subsystems: settings storage and restoration, status reporting, G-code parsing, protocol dispatch, motion planning, and step-segment generation. The compiled firmware contains GRBL-specific internal structures, call relationships, command sequencing, and private implementation constants that are not necessary merely to provide a GRBL-compatible serial interface.
Among those fingerprints are GRBL’s characteristic planner thresholds around ±0.999999, the private REQ_MM_INCREMENT_SCALAR value of 1.25, the organization of settings_restore(), the settings-reporting sequence and axis loops, the architecture of gc_execute_line(), and the relationship between protocol processing, system commands, G-code execution, planning, and step generation.
The analysis is reproducible. The firmware hash, scripts, disassembly evidence, machine-readable results, and provenance packages have been published so that other people can obtain the same publicly distributed firmware and independently verify the findings.
In other words, this is no longer reasonably described as simply “a controller that happens to speak GRBL.”
The evidence strongly indicates a source-derived ARM, four-axis modification of GRBL 1.1f.
The bargain behind the GPL
There is nothing wrong with a commercial company using GRBL.
That is the entire point of free and open-source licensing.
A company may take GPL software, modify it, improve it, adapt it to new hardware, put it inside a commercial product, and make money selling that product.
The GPL does not prohibit commerce.
What it does prohibit is accepting the freedoms provided by GPL-covered software while denying those same freedoms downstream.
GPLv3 section 6 governs distribution of covered software in object-code form and requires access to the Corresponding Source under the applicable distribution method. The license is deliberately structured so that recipients can study, modify, rebuild, and redistribute covered software rather than receiving only an opaque executable.
That is the bargain.
You get the source.
You get the right to modify it.
You get to build your product on years of work performed by an open-source community.
But when you distribute the resulting GPL-covered program, you do not get to convert that community’s work into a one-way street.
Then we found the lock
Reverse engineering of the 3030-PROVer MAX firmware uncovered another layer.
Before normal operation, the firmware communicates with a hardware security device using a proprietary single-wire protocol on the controller board.
This is not a simple “is a chip present?” test.
The firmware implements a substantial authentication system involving DES, two-key 3DES EDE, SHA-256, HMAC-SHA256, random challenges, persistent security-device storage, session-key establishment, and smart-card-like authentication commands.
The protocol includes operations analogous to:
- internal authentication, where the security device proves knowledge of a shared secret;
- challenge generation;
- external authentication, where the controller proves knowledge of another secret;
- HMAC-SHA256 authentication;
- session-key generation;
- authenticated or encrypted storage operations.
These are not inferences from behaviour alone. The canonical DES permutation tables and the SHA-256 round constants are present verbatim in the distributed binary, at fixed addresses that anyone can check for themselves.
The firmware also contains explicit failure paths associated with strings such as:
encryption
authentication
failed!
There is persistent provisioning data associated with the security system as well. If authentication or expected stored state does not match, normal firmware startup can be deliberately prevented.
This means the commercial firmware is not merely a modified GRBL build.
It is a modified GRBL build surrounded by a hardware authentication scheme intended to distinguish an authorized controller environment from another board attempting to execute the same firmware.
The irony is difficult to miss.
A software project released specifically so that others can obtain, modify, rebuild, and redistribute its source appears to have been incorporated into a commercial firmware whose vendor has not provided that source, and that firmware then includes additional technology restricting where the resulting binary will operate.
GPLv3 was written with hardware restrictions in mind
This is where the distinction between ordinary product authentication and GPLv3 becomes important.
A manufacturer is not automatically violating the GPL simply because its firmware checks for particular hardware. GPL software does not have to run on every clone or every remotely compatible controller.
The crucial question is narrower:
Does the authentication system prevent the owner of the original product from installing and executing their own modified version of the GPL-covered software on that product?
GPLv3 specifically addresses this problem for covered “User Products.”
Its definition of Installation Information includes methods, procedures, authorization keys, or other information required to install and execute modified versions of covered software. The license further states that the information must be sufficient so that continued functioning of modified object code is not prevented merely because the software has been modified.
The GNU Project’s own explanation of this portion of GPLv3 is even more direct. It explains that the information required to permit modified software to run may include cryptographic keys or information necessary to bypass a hardware integrity check.
This was one of the major changes from GPLv2 to GPLv3.
The practice became widely known as “tivoization”: using GPL software in hardware while designing the hardware so that users cannot actually exercise the freedom to modify the software running on their own device.
GPLv3 was deliberately written to address that contradiction.
One important qualification, and it should not be glossed over. The authentication described above is performed by the vendor’s own application firmware, and its evident purpose is to stop that firmware running on hardware other than the vendor’s controller. That is a different thing from preventing an owner installing their own modified build on the machine they bought, which is what the Installation Information provision addresses. Whether the latter is the case depends on the behaviour of the device’s bootloader, which SainSmart does not distribute and which has not been examined. Until it is, that question is open, and this record does not assert an answer to it.
Whether the Genmitsu 3030-PROVer MAX meets every legal condition necessary for GPLv3’s Installation Information requirement is ultimately a legal question, and the precise effect of the security system on user-built firmware still deserves further technical investigation.
That conclusion should not be skipped.
But the existence and purpose of the authentication mechanism are now legitimate subjects of that investigation.
SainSmart is now reviewing the matter
A request for the Corresponding Source was sent to SainSmart on August 17, 2026.
The company’s initial support response asked for the purpose of the request and purchase information.
No source code was provided.
After the issue was documented publicly, SainSmart, an operating name of Vastmind LLC, subsequently stated in writing that it is conducting an “internal compliance review” and that its technical and engineering teams are reviewing the relevant source information.
The same general response has since been made publicly through SainSmart’s social-media presence.
That is meaningful progress.
It is not an admission of GPL noncompliance, and it should not be represented as one.
It does establish that the company is aware of the issue and is now treating it as a compliance matter rather than an ordinary support request.
The simplest resolution remains remarkably simple:
Publish the Corresponding Source.
And, if installation of a modified GPL-covered build on the original product requires authentication information covered by GPLv3’s Installation Information provisions, provide that information too.
Why this matters beyond one CNC router
Open-source licenses are not a pool of free engineering labor for companies to draw from while returning nothing.
GRBL exists because developers chose to make sophisticated motion-control software available to everyone under a license designed to preserve downstream freedom.
Commercial manufacturers benefit enormously from projects like it.
They avoid years of development.
They gain proven motion planning.
They gain G-code parsing.
They gain acceleration management, coordinate systems, homing, probing, real-time control, reporting, and an existing software ecosystem.
There is nothing wrong with benefiting from that work.
The problem begins when a company accepts everything open source gives it and then attempts to remove the “open” part for everyone downstream.
And if the same product adds cryptographic machinery whose effect is to deny users the practical ability to run modified versions of that GPL-covered software, the contradiction becomes especially stark.
GPLv3 is not anti-business.
It is anti-one-way-deal.
Use the code.
Improve it.
Sell products containing it.
Make money.
Just honor the license that gave you permission to do those things in the first place.
The complete technical record, firmware hashes, correspondence, reproduction instructions, and provenance-analysis packages are published at:
Readers are encouraged not to take the conclusions on trust.
Download the firmware.
Verify the hash.
Run the analysis.
Examine the evidence.
That is, after all, what open source is supposed to make possible.
Sources for the licence claims: the GPLv3 Final Rationale (https://www.gnu.org/licenses/gpl3-final-rationale.pdf) and A Quick Guide to GPLv3 (https://www.gnu.org/licenses/quick-guide-gplv3.pdf).