Reverse-engineering case studies.

An official APK investigation follows TOTP methods in Aegis and publishes artifact identities and selected Evidence.

Trace a packaged Electron clipboard path using REA findings and separate source inspection; the dynamic wrapper remains a stated limit.

The author describes REA-assisted Android investigation followed by separate Hermes decompilation to support a Windows BLE printer.

An independent video editor whose authors document REA-assisted investigation of Jianying/CapCut behavior and project formats. The public implementation includes a local timeline, FFmpeg export and an experimental, lossy draft importer.

Reimplements the CF632BLE scale’s BLE protocol and body-composition calculations from research on the vendor’s Unique Health Android app. A static Web Bluetooth client receives measurements, manages device profiles and keeps its history in browser storage.

Reads and rewrites supported native Axure RP 11 documents through a binary-record codec, reference-aware cloning and constrained interaction writers. CLI and MCP interfaces expose inspected edits while keeping offline structure checks separate from native application acceptance.

An author-reported Claude Code and REA workflow replaces the macOS streamer’s capture, encoding, audio and input layer with Linux implementations while reusing vendor protocol libraries. The documented result targets desktop streaming and video playback, not Windows-only VR game streaming.

Publishes React components, motion helpers and design-system notes derived from the author’s reported REA investigation of Claude Desktop. It is useful as an interface-reconstruction case, with version-specific observations; a complete assistant application and backend clone remain outside the documented scope.

An unofficial Plex client built after the author investigated LG webOS native media interfaces with Ghidra and coding agents. It draws its own Rust/OpenGL interface and uses the television’s decoder, with documented host, simulator and real-device test tiers.

REA’s case traces the installed Windows Calculator model DLL to explain different percentage behavior for multiplication/division and other operations. An analyst-selected function is interpreted against public Microsoft source and demonstrated with fixed browser examples.

The author reports using Codex and REA analysis to adapt a separate macOS Feishu copy with its own application identity, data directory and single-instance lock. The account describes local signing and separation checks while retaining the original app unchanged.

The authors describe this Rust image editor as a clean-room reimplementation of Photoshop-style workflows. Its document engine, UI and automation interfaces share editing commands, while the source distinguishes PSD editor round trips from byte preservation in the standalone file codec.

The authors describe WordCraft as a clean-room Rust implementation of familiar Microsoft Word workflows. It provides its own document model, layout engine and DOCX reader/writer, with desktop and browser interfaces; source tests exercise selected editing and file-preservation behavior.

The authors describe GridCraft as a clean-room Rust implementation of Excel-style spreadsheet workflows. A workbook model, formula parser and dependency-driven recalculation are connected to XLSX I/O and a shared editing-command layer for desktop, browser and automation interfaces.

The authors describe DeckCraft as a clean-room Rust implementation of PowerPoint-style presentation workflows. Its slide model, rendering and command layers support desktop/browser editing and PPTX interchange; reviewed source tests check constructed decks and selected preserved package parts.

The maintainer reports using REA and Ghidra to study selected QuickBooks Desktop for Mac behavior, then independently implements a local accounting application. Its Python/SQLite engine persists double-entry journals, invoices, inventory and payments, while public synthetic fixtures test bounded accounting and rollback behavior.

A teaching case with disclosed prior source access carries a REA-assisted investigation of a small command-line app into a separate Node implementation. It preserves observed task editing, persistence and selection behavior, then compares scoped outputs against fixed expectations and captured reference sessions.

Reconstructs the Johnny Castaway screensaver engine in Rust, with author-disclosed REA and Claude Code use. It reads original files to run recovered animation scripts and calendar-based story state on modern desktops; documented deviations and limited tests stop short of complete behavioral equivalence.

The author reports using REA to map Screen Studio’s Electron package, reading six auto-zoom and cursor rules from its obfuscated code with Claude Code’s help, and having Claude Code write an independent recorder and renderer from those rules. The article describes the commands, evidence, a cursor-alignment check and the clone’s gaps; neither the clone nor the decoded code is published.

Reimplements the glyph-wind background of the Claude desktop app’s Claude Code New session view as an offline WebGL2 page with a 38-slider control panel. The author reports a static REA investigation of the desktop shell and its remote web bundle, followed by a newly written renderer that reuses recovered timing and layout values. It shares the original’s visual vocabulary and interaction model.

A Chinese article breaks three versions of a Python CSV exporter that reproduces the Notes teaching app shipped with REA. It shows that a simple export-and-read-back test passes all three, while byte comparisons against the official JavaScript formatter on 215 fixed inputs catch each one. The author also connects REA 6.5.0 over MCP, reruns its JavaScript analysis and checks that an edited evidence record is rejected on import; the article studies acceptance checks.

An Android TV browser follows BrowseHere's remote-control interaction design with its own implementation. The author reports using REA to inspect the BrowseHere APK and Claude to build Sofa; the repository documents APK releases, screenshots and current feature limits.

A Rust desktop reconstruction of Mekhanotronika Fast View 5 uses REA and Ghidra research to reproduce oscillogram analysis and relay-characteristic views. The project publishes behavioral specifications, factual indexes, screenshots and cross-platform builds, with explicit format and visual-fidelity gaps.

A Rust/Tauri disk analyzer combines REA/Ghidra investigation of WinDirStat 2.5.0 with source-code ports of its treemap and color handling. Its documentation distinguishes binary-confirmed findings from source-derived algorithms and leaves several file actions and Windows integrations untested.

A Windows Sony-headphone client adopts existing libmdr/libmdr-bt engine DLLs after a documented REA-assisted binary inventory and source review. The desktop interface is modeled on Sound Connect, while protocol implementation and device support are inherited.

A macOS recorder is informed by OBS architecture research using REA package inspection, platform tools and public source references. It offers screen/camera recording and streaming with a deliberately smaller scene/source feature set; the research notes record unavailable native-analysis providers.

A Rust canvas models Paper-like editing behavior after REA investigation of the Paper Desktop shell. The hosted editor was not recovered: research separates observed shell integration from inferred editor features, and the new geometric document model differs from Paper HTML/CSS.

The authors describe CADCraft as an open-source, clean-room computer-aided design and drafting application built in pure Rust. The README documents a 2D/3D CAD workflow with a command line, object snaps, layers, dimensions, hatches, blocks and DXF, and calls the project early development.

The authors describe DesignCraft as an open-source, clean-room page layout and desktop publishing studio built in pure Rust. The README documents native and WebAssembly builds and calls the project pre-alpha.

The authors describe EffectCraft as an open-source, clean-room motion graphics and visual effects studio built in pure Rust. The README documents native and WebAssembly builds and estimates about 91% of its tracked features.

The authors describe FigCraft as an open-source, clean-room interface design and prototyping tool built in pure Rust. The README documents native and WebAssembly builds and estimates about 49% of the parity needed to replace proprietary design tools for real work.

The authors describe FilmCraft as an open-source, clean-room nonlinear video editor built in pure Rust. The README documents native and WebAssembly builds and reports about 86% feature breadth and about 56% readiness for real production work.

The authors describe LightCraft as an open-source, clean-room non-destructive photo library and raw developer built in pure Rust. The README documents native and WebAssembly builds and calls the project alpha.

The authors describe PdfCraft as an open-source, clean-room PDF reader and editor built in pure Rust. The README documents native and WebAssembly builds and reports 57% of tracked features and 94% of commands.

The authors describe SoundCraft as an open-source, clean-room digital audio workstation built in pure Rust. The README documents native and WebAssembly builds and reports 94% menu coverage, about 70% feature presence and roughly 40% readiness for real work.

The authors describe VectorCraft as an open-source, clean-room vector illustration application built in pure Rust. The README documents native and WebAssembly builds and reports about 88% of core menu items.

A cross-platform Rust rebuild of Picture Man 1.55 (1991-1993), the true-color image editor for Windows 3.x, per the project README. The README says no original source survived and the algorithms were recovered by disassembling PMAN.EXE and its converter DLLs.

RE:Notepad reconstructs Windows 10 Notepad behavior in a Rust and Win32 editor with a Windows 11-style interface. The author reports using REA and Ghidra to inspect notepad.exe and records function-linked findings on encoding detection, line endings and editing behavior in a separate specification.

A Linux client reconstructs Audionic Trance Airbud 850 BLE controls from analysis of the Audionic Suite Android app and Jieli SDK references. It implements RCSP framing, mutual authentication and GTK controls for battery status, audio modes and EQ; the author reports using REA with JADX during the static investigation.

JTrac 3 is an independent issue tracker informed by the author's REA MCP study of the JTrac 2.3.3 WAR. Inspection of its bytecode and application files informed a feature catalogue and persistence model; the new implementation uses Java 25, Spring Boot 4, React 19 and PostgreSQL 18 for workflows, custom fields and issue management.

Reversed engineering Icsee is a Swift macOS viewer for local iCSee and Xiongmai cameras, informed by REA inspection of an Android app and native SDK and by authenticated RTSP tests. It provides multiview video, local authentication, camera controls and SD-card recording access through a separate macOS implementation.

qcywatch reconstructs QCY Watch GT2 control and watch-face upload from the QCY Android app, BLE captures and face files. Its Linux scripts create and upload faces, read device information and battery state, sync time and send notifications. The author reports using REA to recover the face container layout.

hexgrab is a Windows WPF color picker built after a REA investigation of the shipped PowerToys Color Picker. The author documents findings from its .NET and native DLLs, including timer-based pixel sampling and clipboard retries, then implements a smaller picker with a global hotkey, screen overlay and HEX copying.

Windows Live Mail 2012 research reconstructs the Japanese edition's UI layout, resource and message-store formats from an owned installation. The author used REA for PE resource inventory, Ghidra for DLL loader analysis and Python decoders to document UIB layouts, RLE images, ribbon definitions and ESE read status. The rebuilt mail app remains private; the repository publishes tools, specifications and findings.

anova-power-cli reconstructs G*Power 3.1.9.7's one-way ANOVA power calculations in a Python CLI and MCP service. The author describes inspecting G*Power with REA and Ghidra, collecting GUI outputs, and implementing five calculation modes; the author reports 245 matching fields across the stated comparison set. The optional Claude agent and its evaluation code are present, with a live LLM evaluation still pending.

Plaude Archiver reconstructs the Plaud Note Pro recording transfer protocol from analysis of the Android app, using REA and JADX in the documented workflow. Its macOS client obtains account keys once, establishes the encrypted BLE session, downloads recordings and decrypts them to Ogg Opus files. Protocol notes cover GATT characteristics, packet framing and handshake variants.

OpenPDF Studio builds a local macOS PDF editor informed by REA-assisted observation of WPS Office 12.1.28496's PDF interface. Its research records editing interactions and limited Mach-O module inspection, while the implementation uses React, Electron, PyMuPDF and Apple Vision for text and image edits, conversion and OCR.

Keymarks rebuilds Powermarks 3.5's keyword-based bookmark workflow as a Windows Tauri app with SQLite search and a browser extension. Its author used REA with Ghidra to recover the undocumented pm35.htm record layout from pm.exe and implemented import and export for that format. A separate feature inventory draws on the original manual, changelog, settings and executable strings.

MiPods reconstructs Xiaomi earbuds control in a macOS menu-bar app using a recovered BLE GATT protocol. Its Swift core handles battery readings, device information and model-dependent noise controls, while research notes document hardware probes, vendor-app analysis and recording-transfer exchanges. A separate report describes REA-assisted analysis of Xiaomi's Mac app.

Taskly is an offline kanban app whose Electron desktop shell was reconstructed from Trello's app.asar using REA. The analysis covers window inventory, geometry, IPC channels and preloads; the board interface and local document storage are new implementation work. A separate report records the investigated package and recovered shell details.

mystery-sdl ports the Microsoft Plus! Mystery screen saver to SDL2 on Linux. After REA-assisted analysis of the original binaries, it reimplements sprite, animation and sound services in C, translates the plugin logic, and reads scene data from the user's Mystery.dll.

Uses measured USB-volume behavior and a macOS audio proxy to map volume keys to a KEF LSX II’s LAN control. The project reports more even steps while forwarding USB audio; the speaker firmware is unchanged.

Implements an unofficial native Linux host for NetEase UU Remote, using protocol behavior the maintainer says was recovered from official-client traffic and shipped programs. The Rust implementation connects selected desktop, input and auxiliary-tool channels to Linux services; an additional Linux viewer remains experimental. The author attributes development to Claude and Codex, without establishing REA use.

Implements selected TCL Home air-conditioner controls and electricity reporting in a native macOS menu-bar app. It adapts earlier community protocol work and documents an Android-module investigation to recover a separate statistics request. Reported validation checks cloud state.

Stands in for the Claude in Chrome extension side of Claude Code’s local browser bridge and runs the requested actions in Browserbase cloud browsers. The author’s thread describes the reverse-engineered framing, a 4-byte little-endian length before each JSON tool call, and the plugin maps 17 named tools onto Stagehand/CDP operations. It is an archived interoperability shim with several placeholder tools.

Implements an Android replacement for the Meta AI companion app that speaks the Ray-Ban Meta glasses’ own Bluetooth and Wi-Fi Direct protocol, imports media, exposes settings and answers “Hey Meta” with a model the user chooses. The project wiki documents the link layers, encryption, services and Meta-side ownership steps, and lists 153 open questions. Testing is on real glasses rather than test suites, so behavior beyond the stated model and firmware remains unverified.

Extends Wine 11.17 so that signed MSIX Store apps, with Shapr3D as the main target, install and run on Linux without their source or symbols. About 49,000 changed lines add a DirectComposition implementation, composition swap chains and an app-model host, while Microsoft’s own XAML and app-model DLLs, harvested from a Windows 11 image on the user’s machine, run unmodified. The author says Claude did most of the reverse engineering and code; app support is uneven and checked by a project regression suite.

Documents the proprietary .rkd telemetry format written by Race-Keeper “Instant Video” recorders, whose bundled player runs only on Windows, and implements matching Python and Go parsers that export GPS and IMU channels as Telemetry Overlay CSV and GPX. The author credits Claude Code with the hex-dump analysis and hypothesis testing, anchored by known car IDs, circuit location and speeds. Field meanings rest on physical cross-checks from the author’s own recordings, and several record types remain partly unknown.

A native macOS app that reaches the Elgato 4K X capture card’s 10-bit P010 video mode, which the project says Apple’s built-in webcam driver does not expose to apps. A root helper detaches that driver and runs the card’s USB Video Class streaming directly through libusb, feeding a Metal HDR viewer, an HDR10 recorder and an editor. Latency figures and device coverage remain author-reported.

A native macOS menu-bar app that pairs with an LG webOS TV over its local encrypted WebSocket interface to launch apps, switch inputs, adjust volume and picture settings, send pointer input and cast selected media. The project credits the public Connect SDK for webOS protocol behavior and reuses PyWebOSTV’s registration manifest. Testing covers one TV on webOS 5.0.

Reimplements control of Samsung Galaxy Buds over their proprietary RFCOMM serial protocol in a cross-platform desktop and Android manager. The author reports recovering the message format by analyzing the earbuds’ binary stream and disassembling Samsung’s official Android apps, and publishes partial packet notes for the 2019 Buds and the Buds+. Beyond the official app’s settings, it exposes battery statistics, diagnostics, factory self-tests, hidden debug information and firmware flashing for supported models.

Native Windows client that aims to preserve the familiar Windows Mail and Calendar experience while rebuilding its functionality. The upstream README documents a WinUI 3 interface, mail and calendar providers, contacts, tasks and offline workflows.

Replaces Honda RoadSync’s Apple Music-only media control with an iOS app that pairs with a Honda PCX 2025 TFT dash over Bluetooth Low Energy and turns handlebar presses into system-wide commands for any player. The author documents the dash’s BLE services, key exchange, button registration and event bytes, reportedly worked out from the official Android app and logged traffic. Results are author-reported on one PCX125, and the protocol notes separate confirmed from unverified parts.

Replaces ScanSnap Home for a Fujitsu/PFU ScanSnap iX500 on macOS with a SwiftUI app and Python service that scan over Wi-Fi through the community-reverse-engineered VENS protocol, or over USB through SANE, and produce searchable PDFs. It vendors bramheerink’s GPL-2.0 driver, extends it for macOS, and documents further handshake and hardware-status fields, including the scan-button bit. Results are author-reported; the repository publishes no tests or captures.

Implements a Garmin watch companion as a native macOS menu-bar app that pairs over Bluetooth, receives live health notifications and original FIT files, and can upload them to Garmin Connect. Source comments attribute its GFDI framing, handshake, file-transfer and status fields to analysis of a supplied Garmin Android package, cross-checked against community implementations such as Gadgetbridge. Device verification covers one watch model, and the opt-in MCP and HTTP interfaces expose only locally cached data.

Reimplements the MASQUE mode of Cloudflare’s WARP client in Go, tunnelling IP traffic over QUIC/HTTP/3 with Connect-IP (RFC 9484) and exposing it as a native TUN device, SOCKS5 or HTTP proxies, TCP-only L4 proxies or port forwarding. RESEARCH.md describes how the author worked out device enrollment, TLS client authentication and Cloudflare’s non-standard cf-connect-ip variant by analyzing the official Android client with Frida, mitmproxy, JADX, IDA Free and Wireshark. It registers with and connects to Cloudflare’s service outside the official client.

Reimplements Winamp 2's main, equalizer and playlist windows in HTML5 and JavaScript, with Web Audio playback, volume, balance and equalizer, and renders original classic .wsz skins, which its documentation says match Winamp 2.9 pixel for pixel; Milkdrop presets run through the Butterchurn WebGL port. It ships as the webamp npm module for embedding in web pages, and the same monorepo runs webamp.org and the skins.webamp.org skin museum. Its webamp-modern prototype targets Winamp 3/5 modern skins with an interpreter for MAKI skin scripts, whose undocumented bytecode format the author reverse engineered and documents in the repository.

Replaces the WHOOP companion app with offline macOS, Android and iOS clients that pair with WHOOP 4.0 and 5.0/MG straps over Bluetooth, decode their vendor GATT frames, offload the strap’s history into local SQLite and compute recovery, strain, HRV and sleep on the device. A versioned protocol reference documents framing, checksums, commands and sensor records per strap family, building on the community my-whoop and goose projects. WHOOP 4.0 is the supported path; deeper WHOOP 5.0/MG metrics and Oura ring support remain experimental.

Replaces NIIMBOT's own label app with a browser client that designs labels and prints them over Web Bluetooth or Web Serial, with Android (Capacitor) and Windows (Tauri) builds of the same interface. Printer communication comes from the same author's NiimBlueLib, which the README calls the most complete implementation of the NIIMBOT protocol; the protocol is documented on the NIIMBOT Community Wiki, and owners of models that do not print are asked for a packet capture of a print made with the official app. The README says the client runs entirely in the browser and keeps label data there.

Reimplements the Bluetooth Low Energy protocol of the Oura Ring Gen 3/4/5 in Rust crates and an oura command-line client that pairs with, authenticates to and syncs a ring directly, with no Oura account or cloud service. The author reports recovering the GATT layout, packet framing and AES app-auth flow from the decompiled Android app, and porting history-event decoders and several on-device metrics, such as HRV, sleep debt and nightly temperature baselines, from Ghidra decompilations of the app's native libraries. Event bodies are stored raw in SQLite so they can be re-decoded as decoders improve.

Recreates part of Sony’s mobile-only Headphones app as a Windows, Linux and macOS desktop client that changes noise-cancelling, ambient-sound and virtual-sound settings over a Bluetooth RFCOMM connection to a paired headset. The author reports reverse engineering the phone app to define its control protocol, and the code rebuilds its message framing, with start and end markers, byte escaping, sequence numbers, a sum checksum and acknowledgements, together with the two set-parameter commands the client sends. Full support is reported for few models, mainly the WH-1000XM3, and the project is archived.

Reimplements the cloud control path of the C by GE (now Cync) smart-bulb app as a Go library and a small self-hosted web app. The author reports decompiling the Android app with Apktool, finding its JSON HTTP API for login and device lists and a separate raw TCP protocol to the vendor's server, then working out that protocol's type-and-length message framing and packet encodings from proxied traffic and the Smali code. The resulting API lists devices, reads their status and sets power, brightness, color tone and RGB color.

Clickwill reconstructs direct editing of iPod classic and iPod nano music libraries in a Swift Mac app. It reads and writes iTunesDB and ArtworkDB on the device, preserves unknown record bytes, handles hash58 signatures and publishes a byte map that distinguishes measured fields from uncertain ones.

spark-mail-linux rehosts the Windows Spark Mail desktop app on Linux with Wine, two compatibility DLL shims and launcher scripts. The project documents application startup, browser authentication, notifications, clipboard and file-opening behavior, then patches specific DLL imports and bridges those functions to the Linux desktop.

OpenTracks is an early UWP port of the OpenTracks7 BETA1 Windows Phone music app informed by the author's reverse engineering. Its C# and XAML implementation updates page control access and replaces WP7 MediaPlayerLauncher with UWP media playback APIs.

The RTO eChalan report investigates an Android APK impersonating an Indian government eChallan service through manifest review, JADX decompilation and sandbox analysis. The author reports identifying a BankBot variant, a REQUEST_INSTALL_PACKAGES permission, a BIND_VPN_SERVICE entry and extensive obfuscation that limited decompilation.

AOL 7.0 Retro Server implements local Python servers for the 2001 AOL 7.0 client. It reconstructs the proprietary P3 login and security exchange, the handoff between login and BOS servers, and post-login data used to display the welcome screen and buddy list.

SteelSeries Overlay Hook documents IDA analysis of SteelSeriesGameOverlay.dll’s window, object layout and Direct3D 11 swapchain, then uses recovered offsets in a C++ DLL hook. Its injector and hook render Dear ImGui content through the existing GameOverlay window by intercepting Present and ResizeBuffers.

An investigation of WeChat 4.1.10 for macOS reports recovering per-database SQLCipher keys by breaking on CommonCrypto encryption calls in LLDB. It compares that approach with memory scanning and sqlite3_key breakpoints, and describes an offline check against a decrypted SQLite page.

Siriously investigates how macOS 27 changed access to Writing Tools and restores its popover through a Services client. The author used Objective-C runtime introspection and behavioral tracing to identify private WritingToolsUI classes, then passes selected text to the popover and writes accepted results back through Accessibility APIs. The findings concern one macOS build.

tuya-mobile reconstructs Tuya mobile-app request signing, encrypted API calls and MQTT signaling credential derivation in Python. It replaces the app's native libthing_security.so signing step with HMAC-SHA256, SHA256 and MD5 calculations and includes versioned Smart Life and Tuya Smart profiles.

ddg-tenor-bridge redirects Gboard's Tenor GIF searches to a service that returns DuckDuckGo animated-image results in Tenor v2 response form. Its documented workflow changes Gboard's persisted search URL flag while leaving other Tenor features on their original endpoint.

MSP CSV Export Format reconstructs the undocumented CSV export of the My Stocks Portfolio & Market app. The author compared eleven iOS exports, app displays and public translation strings to describe columns, blocks and transaction replay. A dependency-free Python parser and synthetic export exercise the documented rules and flag malformed input.

Benro Polaris Firmware Patcher investigates the Polaris camera controller and repacks a user-supplied firmware image with a newer libgphoto2 stack and targeted pgphoto changes. Its documentation maps Benro Connect app behavior and the TCP messages used to control the device. The author reports end-to-end testing with a Canon EOS R5 Mark II.

This malware-analysis report investigates a trojanized FL Studio installer that bundles an Electron/NSIS wrapper and a Go information stealer. The author traces the wrapper statically and studies the payload in an isolated Windows environment with process, registry and network observations, recovering its reported command-and-control mechanism.

grsimwrite-mac reconstructs the Windows GRSIMWrite 4.4.10 SIM-writing workflow in Python for macOS. Its research records card-family profiles and APDU write behavior, while the implementation identifies cards, reads elementary files, writes selected fields, and builds formatting sequences.

dola-client reconstructs access to the Dola AI Android app API from captured phone traffic. It provides Python signing and API-call code, a demonstration chat CLI, and session import from a logged-in Android app or browser cookies.

mcp-fitbod maps Fitbod backend endpoints and serialization schemas from decompiled Kotlin models in the Android app, then uses the documented interface in an MCP account client. Its endpoint map and schema notes identify request paths, model fields and wire names, including JSON:API and Moshi naming differences.

FlyBird-ProtocolAnalysis investigates the FlyBird proxy client's subscription delivery and APXS v2 format across Windows, Android, Linux and OpenWrt. Its reports describe client static analysis, process-memory inspection, GDB breakpoints and TLS observation; accompanying code decrypts the envelope and reproduces the documented mTLS request flow using user-supplied account credentials and certificates from the user's installed client.

SwiftCUA reconstructs the behavior of a macOS computer-use service in Swift 6 after studying the Codex Computer Use.app bundle, its local IPC, permissions and input engine. It provides a background service, CLI, JavaScript bridge and MCP servers for accessibility inspection, screenshots and input, with separate research reports on the original.

IOSVM ports Darwin/XNU components so user-supplied iOS 16.5 user space can boot in QEMU on Linux. Its QMP input channel and web/VNC bridge expose taps, swipes, keyboard input, and rendered frames; the author reports that home-screen boots remain intermittent and rendering uses a CPU rasterizer.

A specification reconstructs the .tsl.json preset format used by BOSS Tone Studio for the GX-10 processor. It maps the JSON structure, hex-encoded parameter arrays, patch names, effect routing and control assignments, with Python examples and research notes.