Reverse-engineering case studies.

This decompiles the Wii Forecast Channel, version HAFE v7, USA/NTSC. The WAD is copied to orig/HAFE. python configure.py accepts --version for a version other than HAFE. ninja builds the project, and objdiff.json is written after the first successful build. Linux and macOS download wibo.

This is a work-in-progress decompilation of the Xbox 360 kernel, file set 21256.18_D, kernel version 17489.0. xboxkrnld.exe has SHA-1 a303e3404e8dd0b9e9defd38aa6c37e04eb19101. xboxkrnld.pdb has SHA-1 625c54f4f273c66fd7a08e8b2ff7d1167983eeba. The image goes in orig/21256.18_D. python configure.py and ninja build it. objdiff.json appears after the first successful build.

PICOLOVE implements the PICO-8 API in LÖVE so PICO-8 carts can run as LÖVE programs. The default runtime is LÖVE 11.5, and 0.10.2 and 0.9.2 are also listed. make builds it, make dev reloads in a loop, and make test runs the checks. Cartridge versions above 8 are not implemented, and the runtime uses floating-point numbers rather than PICO-8 fixed point.

DLSS 5 Neural Rendering reconstructs parts of NVIDIA's model from static analysis of nvngx_dlssnr.dll 310.8.0.0 shipped with NBA 2K27. It documents a 153-record weight container, a 71-block Swin/ViT structure and numerical references for selected operators. The author reports byte-for-byte agreement for one FFN operator across 24 comparisons.

linux-apfs-rw reconstructs support for Apple's APFS filesystem in a Linux kernel module using reverse-engineered format knowledge and an incomplete official specification. It mounts APFS volumes read-only by default and offers experimental writes, snapshot mounting and metadata checksum checking.

Recovers selected camera-tuning structures from an Intel Windows driver package and uses them to repair Linux image capture on one ThinkPad model. Public CPFF/AIQB parsers, kernel patches and libcamera changes accompany the author’s Claude-assisted investigation and bounded before/after measurements.

An owner documents identifying an RK3229 TV box, investigating its stock Android ROM and repurposing it with a userspace gamepad driver and Armbian. REA assisted ADB inventory and Android-provider routing; APK analysis and device changes are reported as a mixed workflow.

An owner-authorized XM530V200 camera case uses REA/Ghidra to investigate native Sofia command handlers, then adds local control and Home Assistant integration while preserving stock drivers and recording. The source-only extension documents separate static, emulated-protocol and physical-device evidence.

Nikond750 investigates the Nikon D750 firmware image D750_0115.bin using decryption scripts, CRC checks, module extraction and Ghidra notes. The author reports recovering a three-table XOR scheme, identifying the ARM application and WLAN modules, and tracing a Wi-Fi throughput limit to the BCM43362 hardware; project instructions also include REA tooling.

LemonadeMirror ports the Lululemon Mirror's peripherals from its Android vendor software to Debian and a mainline Linux kernel. The author describes using REA, Ghidra, objdump and device-tree decoding to recover display, audio, microphone and camera settings, then implements kernel patches, a device tree and user-space services.

Bose USB Bridge uses firmware and updater research to select an existing USB audio mode on a guarded SoundLink Flex unit. The macOS LaunchAgent sends scoped USB/HID requests and lets the built-in USB audio stack carry playback; its research notes report REA analysis of the updater and separate CSR filesystem and XAP firmware analysis.

RTX 3070 Ti VBIOS Reverse Engineering documents analysis of an MSI GA104 VBIOS, covering its ROM layout, NPDE and BIT structures, x86 BIOS, compressed UEFI GOP and Falcon fuc5 microcode. Its workflow combines ROM parsers, REA with Ghidra, EfiCompress decompression, envydis and a Falcon MMIO probe; the repository includes scripts, format notes and an envydis ISA patch.

hantek-dso reconstructs USB control of Hantek DSO5000P oscilloscopes in a Linux Python client with GUI, CLI and API. Its protocol reference combines REA and Ghidra analysis of scope firmware, inspection of the original Windows Scope application and live DSO5102P tests. The client reads waveforms and settings, changes controls and retrieves screenshots over the recovered command framing.

A Flipper Zero app that bit-bangs Telink’s SWire debug interface to dump and reflash TLSR825x Zigbee devices, with static-analysis notes on the dumps and freshly written firmware for two of them. For Tuya TS0044/TS0046 scene remotes, the notes trace the stock ~500 ms single-click delay to a double-click window; the replacement firmware drops that window while presenting the stock model IDs to Zigbee2MQTT. The latest Zigbee build is marked unverified for pairing, actions and battery reporting.

Adds emulation of Real3D’s Pro-1000, the SCSI-attached image generator from which Sega’s Model 3 graphics hardware derives, to the Supermodel arcade emulator. It boots user-supplied Pro-1000 firmware from the SDK disc, emulates the board’s interrupt, JTAG and UART hardware, and exposes the firmware’s built-in monitor on the console. Nothing renders yet, and SCSI host communication is unimplemented.

Reimplements in C the firmware of the Wii U’s DMCU, the M68HC11-compatible display microcontroller in its AMD graphics controller, which in Wii mode reads the Video Interface state and configures display output, deinterlacing, scaling and overscan. The README says the work is based on reverse engineering of the original firmware with byte-for-byte matching decompilation outside its scope, and calls it a work in progress. The built image replaces the stock firmware in Wii mode when loaded through the evWii plugin.

Emulates the Lexicon 224, 224X and 224XL digital reverbs so that their own firmware runs in a browser page or a JUCE plugin. The repository layers KiCad schematics, gate-level and board-level Verilog models, an 8080-hosted C++ emulator and analog input/output models, and checks faster layers against slower ones using user-supplied ROMs. It is a work-in-progress hardware-and-firmware emulation whose documentation is still pending.

Reimplements the Boxine cloud services a Toniebox talks to as a self-hosted C server, so the box can fetch audio, settings and over-the-air content locally while the owner controls what reaches the manufacturer. It serves and caches tonie audio, converts other audio into the box’s TAF format, can pass requests through to the original cloud, and adds a web interface, MQTT and Home Assistant integration. Protobuf definitions in the repository describe the box’s freshness-check, RTNL log and TAF header messages.

Replaces the vendor cloud of supported robot vacuums with a local service that runs on the rooted robot beside the vendor firmware and emulates the cloud endpoints that firmware expects, including a miio dummycloud and a counterpart for Midea's MSmart protocol. Its FAQ says each new vendor backend meant reverse engineering data formats, authentication and communication without vendor documentation; Valetudo converts the proprietary map formats into one ValetudoMap format and keeps Kaitai Struct descriptions of Dreame, Roborock and Viomi map files and a Midea protobuf schema as references. It adds a web interface, a REST API with Swagger UI and MQTT/Home Assistant integration, while feature parity with the vendor apps is an explicit non-goal.

Replaces the software on an unlocked second-generation Amazon Echo Dot (2016, codename biscuit) so it works as a local Home Assistant voice satellite over the ESPHome API: EchoMuse's own Go firmware drives the microphones, speaker, LED ring and buttons, and a controller on the LAN handles wake words, devices and a dashboard. Its default emOS mode swaps Amazon's Android userspace for the project's own init and busybox while keeping the Dot's kernel from the owner's boot image. An engineering journal records how codec routes, the mute key and other hardware behavior were worked out by measuring the device and diffing the mixer and DAPM state while stock FireOS plays a sound.

OSIRIS replaces the DSP-board software of Onkyo TX-NR515 and TX-NR717 receivers with its own boot loader, Linux services and DSP code. The project documents the SPI exchange between the main MCU and DSP board, including 1032-byte transfers, frame structure and command meanings recovered from stock firmware and logs.

Virtual MPC Sample rehosts Akai MPC Sample 1.3.0.12 firmware in QEMU using a custom lab kernel and a browser panel for the device controls. The repository documents firmware and device architecture, emulates the panel's UART communication and provides a shell, tracing and mod testing against the user's own firmware files.

OpenJooki replaces the Jooki 2 music speaker's embedded Linux core and provides phone-based control, updates and SD-card recovery. Its technical notes map the device's Ingenic Linux and ESP32 split, storage partitions, Mender update slots and recovery behavior, while the repository contains the replacement Lua services and installer tooling.

Stickwalker ports a matching reconstruction of Pokéwalker firmware to the M5Stack Stick S3. The repository includes firmware source, build tooling and placeholder artwork; users can build with artwork extracted from their own ROM, and a BPV10NF photodiode supplies infrared reception.

sony-bravia-linux investigates the Linux-based, pre-Android Sony BRAVIA platform and reconstructs selected media and portal behavior for owner-run services. Its documentation records observations from 2011–2012 AZ1, AZ2 and AZ3 sets, including remote input, browser media handling and 3D signalling. The repository also contains tools for H.264 3D SEI and related media workflows.

VanMoof BLE implements a Python client for the S5, A5 and S6 bicycle BLE protocols. It authenticates with an Ed25519 certificate, reads and writes documented topics, decodes captured messages, and exposes controls and telemetry according to each model's message format.

open-picpak documents the PicPak 4.2-inch e-ink frame's stock firmware behavior, BLE GATT protocol, and image conversion pipeline. The author reports deriving byte-level findings from the stock ESP-IDF image and a device client, then using those findings in custom ESP-IDF firmware, host tools, and a self-hosted backend.

Hisense AEH-W41H1 local control replaces the air conditioner's cloud-connected Wi-Fi module with ESPHome firmware for an ESP32 board or the stock RTL8710C module. The implementation speaks the A/C's RS-485 bus and exposes climate controls and diagnostics to Home Assistant. Protocol notes describe the frame envelope, checksum, bus roles, and command/status behavior derived from device observation.

nRF52 e-paper tag reconstructs control of an undocumented electronic shelf label with an nRF52832 board and SSD1675A-class panel. The repository records the pinout, 9-bit SPI connection, waveform-table layout and refresh behavior, and provides replacement Zephyr firmware plus a portable C99 display driver.

The MOI3 cluster pipeline study reconstructs the display path from a VW MIB3 head unit to its instrument cluster on a PC bench. It documents a Wayland ivi_share handoff, RGBA-to-YUV conversion, H.264 encoding and RTP/UDP multicast, and supplies shims and a compositor stub for running a user-provided multi-screen-server binary. Ghidra scripts and a protocol extractor support the investigation.

openwrt-dlink-dir842-r1 ports OpenWrt to the D-Link DIR-842 R1 using a pinned base checkout and device-specific overlays. Its engineering notes investigate the RTL8197F and RTL8367S network path, switch setup and hardware NAT, while the build produces RAM-boot and NOR-flash firmware images.

ZOOM F8 BLE protocol documentation reconstructs remote control for F8-family field recorders. It describes advertising, GATT handles, the connection handshake, commands, telemetry, settings and SD-card browsing, while distinguishing live observations from firmware-derived and inferred details.

UAD-2 OCTO-RE investigates the PCIe host transport of a Universal Audio DSP card through driver analysis and experiments on one Rev 5 board. The author reports reproducing command-ring and DMA startup across eight DSPs and recovering parts of the firmware and Bill resource containers. General-purpose DSP execution remains blocked by an unresolved runtime response and opaque payload format.

GameSir Cyclone 2 documents analysis of the controller’s JieLi BR23 firmware, including image layout, instruction encodings, timer behavior and firmware patches. It also describes a Raspberry Pi bridge that maps Bluetooth HID input to an Xbox 360 Wireless Receiver USB interface for Windows XInput.

airport-express-tools reconstructs configuration and Wi-Fi client functions for the second-generation AirPort Express A1392 from firmware and ACP protocol research. Its Python CLI configures Wi-Fi, connection sharing and device settings; a local web UI provides Wi-Fi and device controls. A replacement supplicant joins WPA2 networks. Reference pages map ACP properties, RPCs, firmware contents and client-mode behavior, with Ghidra and unpacking helpers.

Gaomon M10K 2018 research decodes a substitution-encoded GD32F350 tablet firmware image and investigates its sensor loop and USB report path. The repository includes an image codec, constrained patch builder, DFU transaction documentation, and observations from experimental report-rate changes.

nokia105-emu runs a Nokia 105 TA-1423 firmware dump from boot ROM to a usable menu interface. Unicorn emulates the ARM926EJ-S CPU, while Python modules model the SC6531E interrupt controller, flash, display, keypad, power management and other peripherals based on firmware behaviour. The user supplies the phone’s own flash and boot ROM images.

Hisense VIDAA (MT9603) records an investigation of a TV firmware container and browser-facing local services. The notes map the phoenix:// message format, its WebSocket and HTTP transports, a 96-function bridge and permission checks, with sanitized probe outputs. The author reports that the encrypted firmware payload remained inaccessible.

WebTV PTL documents the binary television-listings database used by WebTV Plus and DishPlayer set-top boxes. The write-up describes its location on device storage, big-endian integer encoding, versioned header, block layout and footer.

SL-GlassesLed26x7 documents the connections of a 26×7 charlieplexed LED-glasses matrix and drives it with an ESP32 in place of the original controller. The repository records its pin layout and LED sections, with Arduino display examples and a bitmap generator.

FIFINE SC3 research documents decryption of the mixer's MVsilicon firmware and its ACP control protocol over USB HID. The repository provides cipher and container tooling, protocol findings, and a firmware patch that exposes all four fader positions to host-side volume tools.

HHKB-reverse-engineering investigates the vendor USB HID protocol of the HHKB Professional Classic keyboard. It documents 64-byte request and response frames, command behavior, keymap layouts and firmware-dump behavior, with macOS IOKit tools for probing and changing keymaps.

nano3-os reconstructs the Canaan Avalon Nano 3's K230-to-K210 mining protocol from analysis of btcminer and UART captures. Its notes cover CN frames, CRC-16/XMODEM, job bursts and nonce reports; a Go daemon uses that protocol to run the miner with a Stratum V1 pool, board controls and a web dashboard.

gear360-raw investigates the Samsung Gear 360 SM-R210 camera's capture firmware and calibration data to enable 12-bit Bayer RAW shooting. SD-card mod files trigger sensor dumps, while Python tools convert them to DNG using camera color data and stitch images using the decoded per-unit lens model; command and safety notes document the underlying behavior.

Minager builds a remote monitoring and control client for Antminer ASIC hardware from reconstructed CGI interfaces. Its Go code maps device responses into typed structures and uses Telegram menus for statistics, pool changes, power modes and alerts; the author also reports firmware and packet analysis.

chave-sandeiro documents an investigation of the Renault Sandero turn-signal switch through connector, interior and schematic images. An accompanying Arduino sketch reads turn-signal and headlight inputs from digital pins and prints state changes over serial.

The f407 大绿板 investigation maps the pins connecting an ST7735S display module and five onboard buttons to an STM32F407VET6 development board. It provides display and GPIO probe programs, the author's reported pin assignments and a combined display-and-button demo.

A Dell Precision Tower 5810 and 7810 BIOS A34 investigation maps SMBIOS DA tokens to Dell setting IDs and AMI Setup bytes. It publishes per-model token tables, setting and token maps, setup-form options, and read-only token and byte-scanning tools. The author reports checking selected mappings against live reads and an NVRAM change.

The earbud-case LED display study reconstructs the pinout and electrical drive map of an unmarked charging-case display. It documents 31 segments on eight charlieplexed lines, including ribbon-finger wiring and anode/cathode combinations, and supplies an ESP32-C3 driver and serial probing sketch.

TCL AC Original Module ESPHome reconstructs local control of a TCL air conditioner on its original WL6U Wi-Fi module. The author traced command building and status decoding in a stock RTL8720CF firmware dump, compared selected functions with replacement codecs, and implemented ESPHome controls and readings over the module's UART link.

EKIY / Melis reverse engineering runs the original home-screen firmware of an Allwinner F133-B display in a TypeScript application-level emulator. It documents the observed DATAV1.0 UI format, provides tools to read and rebuild UI packages, and records firmware-specific modification findings using a dump supplied by the user.

vfs495-driver implements a Linux libfprint TOD driver for the Validity VFS495 swipe fingerprint reader. Its documented research traces the sensor's USB handshake, encrypted command and image streams, and firmware patch setup; a build recipe extracts required command data from the user's HP SoftPaq download.

The Potensic ATOM cable investigation reconstructs the directional USB-C connection between a DSRC02A drone controller and an Android phone. Multimeter measurements inform an editable KiCad schematic, wiring notes and a replacement adapter design using SBU/CC connections and two 56 kΩ resistors. The author reports one prototype carrying video and controller input during a short flight.

YBX ESP32 System Emulator reconstructs selected hardware behavior so original ESP32-S3 and ESP32-C3 e-ink reader firmware can run in QEMU. Its patches and host tools model display and touch paths, capture panel framebuffers, and record boot, peripheral and navigation experiments for YBX X4 Pro and CrossPoint images.

A firmware investigation of a Majority Touro radio on the Frontier Venice X/FS2340 platform maps compressed update blocks, menu and language tables, graphics, bootloaders and recovery paths. Offline Python tools parse owner-supplied firmware and extract resources; the author reports recovery of one affected unit.

The Contax N Digital CCD Parameter Disc recreator rebuilds a camera-specific calibration disc from newly captured RAW dark and white frames. It derives white balance, defective-pixel and reference-image files, then combines them with colour matrices and tone curves extracted from another N Digital disc. The author reports comparison with a known disc but notes unresolved factory scaling details.

fosi-md3 investigates the Fosi Audio MD3 USB DAC and implements replacement firmware for its ESP32-S3 controller. Its notes map the USB mux, DAC I2C control, Savitech link and stock settings record from hardware observation and firmware disassembly; the ESP-IDF implementation preserves audio control and photo storage. The author reports testing on one unit.

dataflash-re reconstructs the LWR control protocol used by Lightwave Research Dataflash xenon strobes. It combines 8051 fixture firmware disassembly, schematics and controller captures to document 9-bit serial frames, then implements an ESP32 bridge from Art-Net, sACN and TouchOSC to the original RS-485 link.

opal-c1-revive investigates the Opal C1 webcam's Myriad X hardware, 32 MB NOR flash and DepthAI pipeline. It documents the bootloader and app package, supplies scripts to back up flash and edit the pipeline, and provides a macOS menu-bar app for standard UVC controls.

Spirit Halloween Remote documents radio messages recovered from a Spirit Multi-Prop remote and replays four captured commands through a Raspberry Pi nRF24L01+ transmitter. The protocol notes give the 250 kbit/s setting, channel, address and 22-byte command bodies; an optional Home Assistant bridge exposes trigger buttons.

Thecus N7510 on modern Linux restores the NAS front-panel LCD, buttons, fans and LEDs with Python daemons. The investigation images the original firmware DOM, traces and disassembles its agent2 daemon, then documents serial frames exchanged with the ATmega168 panel controller and maps board pins. The author reports testing on one N7510.

a2854-siri-remote-linux reconstructs Apple Siri Remote A2854 button and voice notifications for a Linux bridge that reads btmon output. It documents GATT button values, a 100-byte Opus audio wrapper, and an IR provisioning sequence observed through HID reports; separate research examines the remote's flash image and IR database.

The HDF / HarmonyOS investigation maps the Driver Foundation's user-to-kernel IPC path and tests selected HarmonyOS libraries on Linux. It records the HDF_WRITE_READ ioctl, HdfWriteReadBuf layout and I2C command IDs, supported by harness code, a kernel stub and QEMU experiment logs.

MK Typist research maps the Mechanical Keyboards MK Typist keyboard and its stock firmware while developing a QMK port. The notes cover its Holtek HT32F52352 board, flash layout, Cheng Yong IAP boot flow, USB identities, update behavior, pinout and captured command output from one unit.

Huawei MUT Unbrick Tool reimplements the multicast firmware upgrade exchange used by HuaweiMUT.exe for router recovery. Its Python GUI and CLI send documented UDP packet types with firmware chunks and INI metadata; research notes record findings from the original utility. The author reports that secure boot prevents software recovery on several listed models.

Tizen T-KTS firmware research maps the VDFS4 filesystem inside a decrypted Samsung smart TV firmware image. Its notes describe superblocks, catalog records, file extents and copy-on-write block translation, while Python tools enumerate entries and locate file data. The author reports 2,113 enumerated entries; payload decompression remains unresolved.

Philips Avent Local Protocols investigates the SCD923/26 baby monitor's QR pairing, encrypted control session, RTSP video and separate ADPCM audio channels. The study combines handheld firmware analysis, isolated ARM emulation and tests against a paired baby unit. It marks discovery behavior and SCD973 authentication as unresolved.

igpsport-binavi-poi reconstructs the iGPSPORT BiNavi's .cnx route track codec and POI type values. Its Python generator combines a GPX track with distance-indexed roadbook points into a device route that shows proximity reminders during navigation; technical notes document the XML layout and observed FIT behavior.

es4308cfg reconstructs the Edgecore ES4308-PoE switch's proprietary NVRAM configuration format from differential exports. The repository documents TLV framing, checksums, obfuscated strings and port-bit permutations, and provides Rust and Python codecs, a Kaitai specification and sanitized fixtures.

microfreak-emu rehosts Arturia MicroFreak firmware 5.0.0.2084 in Renode with models for STM32 peripherals and audio output. Its research documents firmware addresses, stored formats and the SysEx message exchange, while the harness supports boot checks, MIDI-driven differential runs and preset rendering.

Ledger Nano X board map reconstructs the hardware wallet's main board from photos, tracing 40 test pads, copper nets and components into a KiCad project. Photo and 3D viewers expose the mapped connections, while scripts regenerate the board and schematic from the recorded data.

The Pulsar II project reconstructs Linux support for the Creamware/Sonic Core DSP sound card from analysis of scScope.sys and Sim2k.dll. Its kernel module, loader, and SCOPE file decoders handle card initialization, DSP modules, audio streams, and device files; reports document register and boot behavior.

Z80 NMOS Silicon-to-RTL CPU Core reconstructs the Zilog NMOS Z80 processor as synchronous Verilog from a transistor-level netlist and successive logic schematics. The author reports testing a Verilator model with Z80 software suites in EmuStudio.

miband11-watchface-maker reconstructs the .face watch-face package format for Xiaomi Smart Band 11 by comparing inputs and outputs of the official compiler. Its format specification covers headers, metadata, indexes, embedded Lua and image data. Python, Java and JavaScript implementations assemble watch faces from media inputs.

fb200-tools reconstructs the FLAMMA FB200 bass pedal's firmware behavior and USB HID/BLE controls in replacement firmware and device utilities. Its research documents the stock .mr image, command framing, DSP parity work, presets, and update path; the author reports testing selected features on a physical pedal.

Orion Unchained reconstructs Acer Predator Orion desktop lighting control for Linux through a kernel driver, command-line client and desktop app. Its investigation documents PredatorSense lighting payloads, the firmware's AcerGamingFunction WMI methods and the SMBus controller path; the driver uses those findings to set and read lighting effects on the tested PO7-660.

p2afan investigates the Tyan FT77C-B7079 BMC and controls its ASPEED AST2400 fan PWM registers from the host through the PCIe-to-AHB bridge. Its write-up maps BAR1, the PWM block and firmware layout, while the Python controller computes duty from IPMI, hwmon or command output.

Cisco CP-9951 DOOM ports the game to run on the IP phone's ARM CPU using its local framebuffer, keypad, and media path. The accompanying investigation maps the Raven keypad path and a 16-byte input event format from the phone's keyhandle module and hardware observations.

Zeppelin Air Recovery reconstructs the Bowers & Wilkins speaker's USB recovery procedure from its updater library and live DFU exchanges. A Python tool implements vendor commands, flashes the MCU and coprocessor in two phases, and polls the coprocessor until it is ready; protocol notes document the message sequence and flash layout.

EmuWorks recreates the NumWorks N0110 calculator's hardware environment in Renode so ARM Cortex-M7 firmware runs on an emulated STM32F730. Its peripheral models cover the ST7789V display, keyboard matrix, battery ADC and CRC unit, while a Windows app presents the screen and firmware tools. Original Core and Code firmware images are bundled; other firmware is supplied by the user.

CH899 firmware research reconstructs the UART exchange between the clock's MM32 movement controller and ESP8285 Wi-Fi module. It records wake, time and reset messages from stock behavior and implements replacement ESP firmware that adds Wi-Fi setup and timekeeping options while retaining the original movement controller.

telink-usb-ota reconstructs Telink's USB-HID OTA update exchange as a Rust Linux host tool for querying and flashing a CIDOO V65 v2 keyboard. Its protocol notes specify 33-byte HID reports, START and FINISH opcodes, 16-byte data chunks, CRC-16/MODBUS and the next-chunk acknowledgement rule, derived from updater and firmware disassembly and checked by the author against hardware.

K2 OpenKlipper rebuilds the Creality K2 printer control stack around upstream Klipper and open Python modules. Its implementation covers the strain-gauge probe, CFS filament box, closed-loop motors and touchscreen; protocol notes draw on observed printer traffic and behavior.

ThinkCentre Fan Control uses findings from M70t Gen 6 embedded-controller probing and ACPI table analysis to show fan RPM and offer firmware fan modes. The Windows tray app reads the EC tachometer through PawnIO, obtains per-core temperatures from CPU registers and changes supported modes through Lenovo WMI.

strix-890m-macos investigates Radeon 890M display bring-up on an ASUS GA403WM running macOS. Trace notes, IOAccelerator ABI data, Metal and Vulkan probes, and experimental kexts cover framebuffer adoption, OLED brightness and WindowServer attachment; accelerated graphics remain unfinished.

Twin Famicom reconstructs the Sharp console's power board as a KiCad schematic and PCB design based on visual inspection and measurement of an original unit. The repository contains the power-board project and states its hardware-design license.

EasyRazer reconstructs direct controls for Razer analog keyboards in a Windows Synapse replacement. Its Rust and Tauri application manages actuation, remapping, profiles and lighting, with model-specific documentation of keyboard protocol and firmware behavior.

Sisu DCP-3 recreates the Nokia 3210 NSE-8 v6.00 experience as new C firmware for a replacement Rev B2 mainboard. It uses original-firmware analysis to guide behavior and presentation, while documented ROM research reconstructs the battery gauge; fonts, tones and other Nokia-derived assets are generated locally from the user's firmware copy.

vxp reconstructs VideoNow XP player behavior by decoding picture, audio and interactive branch data from disc images. Its .NET player handles XP, Color and original black-and-white discs; a headless CLI inspects, verifies, exports and graphs disc contents.

Zamphenom runs Kemper Profiler firmware in an instruction-level Motorola DSP56720 emulator and exposes its audio through a VST3 plugin. The repository includes update-file unpacking, DSP bootstrap extraction and rig-to-message-stream tools; the author reports a working amp path and delay stomp.

Marstek Offline Endpoint recreates the telemetry upload and time replies expected by Marstek Venus E and D batteries on a local server. The author traces firmware conditions behind network resets, implements the response path in a container and records uploaded measurements locally. The author reports that a Venus D on Control firmware v150 stopped its periodic network interruptions during the documented observation.

An investigation of the ZTE ZXSLC SR1010 maps its NAND partitions, encrypted rootfs, boot and upgrade paths, and config.bin format. Python tools inspect, decrypt, edit and repack owner-supplied configurations and extract firmware components.

esphome-quietcool reconstructs QuietCool fan control over a proprietary 433.92 MHz 2-FSK radio link. Its ESPHome C++ component sends OEM-compatible commands, receives fan status and exposes controls through Home Assistant; the protocol work draws on SDR captures and analysis of two handheld remote firmware dumps.

QuietCool ESPHome replaces firmware on the IT-AF-SMT attic-fan controller and reimplements its stock BLE interface so the vendor app can still control the hub. Its protocol reference draws on analysis of the OEM firmware, Android app, and live BLE captures, while the new firmware adds Wi-Fi and Home Assistant control.

The ReadyNAS RN426 panel project reconstructs front-panel control from NETGEAR's stock firmware so the LCD and navigation buttons work under TrueNAS SCALE. Its Python driver bit-bangs the SSD1305-class display through Denverton GPIO registers and reads button state from an MSP430 over SMBus when its interrupt fires.

The Dahua IP camera and NVR investigation maps device JSON-RPC endpoints, request structure and two-step authentication from internal JavaScript. Module references cover control, configuration, media, events and maintenance methods, with a Python script for login and method discovery.

GNR-SMU maps undocumented AMD Ryzen SMU power-management tables through hardware measurements, load experiments and Linux sensor comparisons. It publishes model-specific field maps and Linux telemetry tools, with guarded controls for Granite Ridge CPUs and read-only telemetry for the Vermeer 5600X.

SACD daemon reconstruction rebuilds Sony BDP-BX510's ARM sacd_extract_160 daemon in C. It documents TCP 2002 sector requests and the CPSA ioctl path, and supplies function-diff tools, QEMU device models and differential captures. The author reports 388 of 390 functions equivalent and byte-identical wire behavior in tested cases.

Holy Stone H120D research maps the drone’s Wi-Fi command, camera and video exchanges using APK decompilation, packet captures and ARM library disassembly. It documents UDP 8080 control frames, UDP 8088 camera commands and H.264 video on TCP 8888, with Python clients and an Arduino controller sketch.

Nokia E7-00 Linux investigates the phone's boot chain and hardware interfaces to build QEMU models and a Linux port. Its notes cover NLoader, OneNAND, GPIO, display transport, USB and memory-card control, supported by probe outputs and kernel code. The author reports a Linux shell in emulation while physical-device bring-up remains in progress.

CTS Strasbourg Ticket Reader maps the SRI512 memory used by Strasbourg CTS paper tickets and provides a C utility to read and decode it through libnfc. The documented fields include ticket type, validity counter, validator ID and last-validation time.

Chronos Revived replaces the discontinued Android companion app for the Chronos smart disc using its recovered Bluetooth LE protocol. It handles notifications, steps, battery status and gestures, and can flash firmware supplied from the user's original APK. The protocol notes map GATT services, status bits, commands and device hardware identified from firmware analysis.

PS2 Floating-point reconstructs aspects of PlayStation 2 floating-point behavior in Rust using console experiments as a baseline. Its Ps2Float type represents the console's floating-point variant and implements addition and subtraction, with test cases for ordinary values and special cases.

CD Changer Robot reconstructs control of a Nistec ALW-501 disc robot after tracing its motor-driver board. The repository supplies a pin map, circuit drawing, Arduino replacement firmware, Python control and imaging scripts, and mechanical parts for bulk CD transfer.

open-ssd reconstructs an initialization workflow for Silicon Motion SM2263-family SSDs. Its Python tool generates parameters, scans bad blocks, packages firmware and writes NAND system areas; accompanying documents map controller commands and JMS583 bridge passthrough behavior. The author identifies one tested SM2263XT, YMTC NAND and JMS583 combination.

t2-cruise reconstructs how a T2 MacBook's Apple SMC requests CPU and GPU power limits. The author compared SMC readings under macOS and Linux, mapped MSLC and MSLG limit steps, and wrote a Linux daemon that applies them through intel_pstate and an optional Radeon power cap.

XENO reconstructs Xbox 360 boot behavior in a low-level emulator informed by boot-chain research and disassembly. Its Rust Xenon PowerPC core models memory, the SMC and security engine, while supporting tools analyze boot stages and XEX files. The author reports execution through the CD handoff and hypervisor guest idle state; later system components remain in progress.

rytm-fw-re analyses the Elektron Analog Rytm MKII OS 1.74 update and builds a freestanding ColdFire replacement firmware wrapped as a flashable .syx file. Its Ghidra probes and notes cover the ELE3 container, bootstrap entry contract, memory map, display byte protocol and flash path. The author reports that the current replacement boots and displays a test pattern.

Nokia DCT Platform Emulation reconstructs firmware-facing hardware behavior of early Nokia phones in MAME, with the 3210 as its reference handset. Its investigation maps registers, buses, DSP mailboxes, SIM exchanges and storage behavior using static and runtime observations. The repository includes disassembly helpers, Ghidra scripts, symbol maps and subsystem reports; the author reports an interactive 3210 desktop under a modeled profile.

ambit-firmware develops alternative firmware for Palette devices using mapped AT90USB1286 pin connections. The hardware notes identify links to magnetic ports, I2C lines, LEDs and flashing headers; the firmware implements USB CDC control, basic LEDs and a failsafe bootloader path. Its roadmap lists display control and component communication as unfinished.

perfectcharge_remote reconstructs the Waeco PerfectCharge marine charger remote's schematic and single-layer PCB in KiCad. The design records its pushbutton, LEDs and two top-side jumper wires, with Gerber and Excellon manufacturing files alongside the KiCad files.

Sony A7 III firmware analysis maps the packaging of Update_ILCE7M3V404.exe from a Packman self-extractor through an inverted MSCF CAB to a UFU TLV container. The write-up records offsets, tags and CRC coverage, and a Python script reproduces extraction and structural checks. The FDAT firmware body remains encrypted.

Capybara reconstructs the Sonix SNC73410 hardware environment needed to run Tamagotchi Paradise factory firmware on a computer. Its Rust emulator implements an ARMv7-M core and peripherals modeled from measurement, imports a user-owned 16 MB flash dump and derives the dump's decryption value before booting it.

ry5088-flasher reconstructs the USB HID-DFU update path used by RongYuan RY5088 magnetic keyboards. A Rust flasher reads the board's dev_id, obtains the matching stock image and transfers it through the documented bootloader protocol. The repository also provides profile-driven AT32F405 reference firmware, whose hardware bring-up is still experimental.

The TJ-56-654 weather-clock project replaces the original ESP-01S firmware after an investigation of the device's hardware and configuration page. The author reports that the original page exposed the Wi-Fi password; the replacement provides NTP time, Open-Meteo weather, OLED screens, a web settings panel, and updates on the clock's 1 MB flash device.

The Torso T-1 backup-format project maps the sequencer's .t1 bank data through controlled device backups and byte comparisons. Python codecs parse and rebuild banks, export patterns to MIDI and import MIDI as device-loadable backups; the author reports byte-exact sample rebuilds and successful hardware imports.

open-smc-pad replaces the M-Vave SMC-PAD controller's firmware with a USB bootloader, runtime and Arduino core. Its stock-firmware research documents the USB-MIDI SysEx service protocol, flash layout and hardware wiring; the implementation supports pads, knobs, LEDs, USB-MIDI and BLE-MIDI.

Predator Sense for Linux reconstructs Acer PredatorSense controls for the Predator Helios Neo 16 PHN16-72. Its documentation traces Windows service behavior and firmware WMI methods, while a Linux kernel module and daemon expose performance modes, fan settings, keyboard lighting and battery controls to a CLI and Qt interface.

HH41V maps the TCL/Alcatel mobile hotspot's FOTA update process, including its AP and modem package structure and GOTU/SUDH requests. It provides Python tools to inspect archive entries, fetch packages and compare package identity with a device configuration dump, plus notes on the updater and package inventory.

Band 9 表盘生成器 reconstructs the Huawei Band 9 HWT watch-face package format from binary observations of public packages and builds installable packages for the 194 × 368 HWHD07 screen. Its format document records ZIP entries, payload layout, protobuf fields, data item numbers and resource slots.

The Echo Show camera project reconstructs camera support for LineageOS 18.1 on Echo Show 5 and 8 devices. Live-device findings trace missing camera providers, legacy MediaTek blobs, kernel struct differences and sensor tuning; kernel patches and userspace shims restore preview and capture. The project also documents Bluetooth and echo-cancellation fixes.

Yamaha SMAF Player reconstructs ringtone playback associated with Yamaha MA-series sound chips in C++. It parses SMAF MMF containers, decodes HandyPhone and Mobile scores and Yamaha voice data, and renders FM synthesis with optional ADPCM samples. The author based the parser and synthesizer on the public SMAF format description and examination of real files.

CoreFW reimplements firmware for Novation Launchpad controllers with accessible bootloaders in Rust. It supplies device-specific drivers, MIDI and SysEx handling, palette editing, performance and programmer modes, and build aliases for supported RGB and earlier non-RGB models.

Open Arcade Coder reconstructs control of the Tech Will Save Us Arcade Coder's 12×12 RGB matrix and buttons with an ESP32 library. The author traced board connections, identified HC595 and ICN2012 control pins, and supplies display and button examples.

6502 Model reconstructs the 65C02 chip’s cycle behavior in Rust from traces of external buses recorded during execution on a physical chip. Contributors add programs and signed traces as failing cases, then implement behavior to match the observed cycles.

D750 QEMU Verification Prototype investigates early execution of Nikon D750 firmware with a QEMU board overlay and host-side scanning and logging tools. The author reports that a selected entry function ran and returned, while the observed fragment produced no MMIO accesses or UART output. A separate toolchain changes selected 1080p bitrate-table entries in a user-supplied firmware image.

ILME-FX30 Service Mode Research maps USB service-session commands and settings on FX30 firmware 6.00. It documents Senser and Jiritsu exchanges, backup structures and static analysis of appFw.so, with scripts for probing the camera. The author reports enabling a hidden continuous-shooting mode through paired settings writes and a cold start.

redmi-perf reconstructs performance-mode control on Xiaomi and Redmi laptops through the MIFS WMI interface to the embedded controller. Its notes map request bytes, firmware responses and mode values; a kernel module exposes the interface, while an optional NVIDIA ACPI shim fills response fields the author says the firmware omits.

ZTE U60 Pro Toolkit investigates the MU5250 router's firmware behavior and extends its controls with an on-device Rust REST agent, web console and mobile clients. Research notes cover hidden web UI settings, SIM Toolkit communication through the RIL socket and firmware power behavior.

Game Boy DMG-CPU Schematics reconstructs the Game Boy DMG-CPU B chip and SM83 core as KiCad schematics, Electric VLSI layouts and text netlists. Its overlay labels cells and wires on chip die shots, while the netlists record their connections and coordinates.

open-cleverpad provides replacement Rust firmware for the MIDIPLUS SmartPAD MIDI controller and a reverse-engineered schematic of its mainboard. The firmware maps pads, encoders and buttons to MIDI messages and adds 64-color pad control.

osdbits reconstructs the PlayStation 2 OSDSYS opening animation as a standalone Emotion Engine program from a retail boot ROM image. It ports towers, fog, light streaks and refractive cubes, and compares output with GS dumps and savestates. The repository also includes VU microcode disassembly and notes on menu rendering; textures are extracted locally from the user's BIOS dump.

FPGABoy reconstructs Nintendo Game Boy hardware in an FPGA design. The repository contains Verilog modules for the console's processor interface, PPU, memory, controls and video output, plus a design paper. The author states that the current version is nonfunctional.

NTRDisasm investigates the NTR 2.0 custom firmware for Nintendo N3DS. Its assembly listing and IDA script support study of code injection, hooks, in-game menus, service handles, debugger components, and privileged ARM11 calls.

NanoBoyAdvance reconstructs Game Boy Advance hardware behavior in a cycle-level emulator. It models CPU, DMA, timers, PPU and Game Pak prefetch, and provides palette, tile, background and sprite viewers. The author reports passing several GBA accuracy suites.

Documents the reverse engineering of Valve's original Steam Controller, whose LPC11U37F main-processor firmware the author ran in a modified pinkySim simulator to log its hardware accesses, and uses the findings to write replacement firmware. Build options turn the controller into a USB-serial development board for querying its peripherals, or into a wired Nintendo Switch controller that presents itself as a PowerA pad. A Qt converter writes MusicXML songs as startup and shutdown jingles into an EEPROM area that the official firmware also reads, and notes record the board's pin connections and USB messages.

Replaces the ESP8266-based Xiaomi desk lamp firmware with an open implementation of the lamp's local power, dimming and colour-temperature controls, based on the documented board wiring.

Replacement firmware for the Snowsky (FiiO) Echo Mini 8 GB player. The stock update image is HIFIECnn.IMG, and cmake --preset release followed by cmake --build --preset release writes build/release/HIFIEC90.IMG.

A scratch-built open ROM BIOS for vintage PC, XT, and 8088-class machines. The shipped assembly source src/GLABIOS.ASM is the build input; src/MAKE.BAT runs MASM and LINK, then GLA2ROM writes GLABIOS.ROM, which the GLA2ROM readme calls an 8KiB ROM image.

Replacement firmware for the RuiDeng TC66 and TC66C USB-C meters. Stock firmware is not in the repository; make release in rust/ writes tc66fw-release.enc.bin, an AES-encrypted image for the stock bootloader.

An archived reimplementation of the Quan Sheng UV-K5 handheld-radio firmware v2.1.27. After the submodules are fetched, make writes firmware.bin and firmware.packed.bin for the radio’s DP32G030.

R64Emu reconstructs Nintendo 64 hardware behavior in a low-level Rust emulator informed by work on actual hardware. It documents the RSP's scalar and vector units, models CPU and console subsystems, and includes a debugger with disassembly, stepping, breakpoints and watchpoints.

Nuked-MD-FPGA reconstructs Sega Mega Drive chipset behavior in Verilog using photographs of decapped chips. Its modules cover the 68000, Z80, graphics, FM audio and supporting chips; progress notes distinguish implemented parts from variants still planned.

CamLink 4K rebuilds the first-generation Elgato Cam Link 4K capture pipeline with LiteX gateware for its ECP5 FPGA and bare-metal C firmware for its FX3 controller. It documents the HDMI receiver, DDR3 frame buffer, GPIF-II link and USB UVC/UAC output, with host tools for flashing and validation.

pw_firm reconstructs Pokéwalker firmware in C for its Renesas H8 microcontroller. It covers device drivers, game logic, interface screens, and infrared communication; the author reports emulator execution and an average binary match near 76%, with the original compiler settings unresolved.

Strato reconstructs Nintendo Switch system behavior in an emulator for ARMv8 Android devices. Its source includes high-level kernel and system-module implementations; the authors describe using Switchbrew and Ryujinx as references and continuing work from Skyline.

Nuked MD reconstructs Sega Mega Drive chipset behavior in C using decapped chip photographs. Its current combination targets an NMOS 68000, NMOS Z80 and FC1004, with separate implementations for video, audio, arbitration, I/O and cartridge handling.

NC2000/1020Emu reconstructs the hardware environment needed to run firmware dumped from Wenquxing NC2000, NC2600 and NC1020 portable computers. Its C++ code models a 6502 SoC, memory mapping, NOR and NAND flash, LCD, sound, keyboard and serial or infrared communication.

m-bootloader reconstructs the boot and flash interfaces of the M-VAVE FM-1 and SMK-37 Pro/Elite synthesizers built around the JieLi AC791N chip. Its specification covers boot stages, SPI flash formats, retained-RAM handovers and the USB flash-loader command protocol. The C and pi32v2 assembly implementation provides a replacement bootloader, recovery menu and RAM flash loader for M-Flasher.

CEN64 emulates Nintendo 64 hardware and aims to model it down to register-transfer level. It runs big-endian .z64 ROMs with PIF data, supports 64DD disk images and provides a GDB connection for debugging emulated programs.

Orbital reconstructs PlayStation 4 hardware in a virtualization-based emulator intended to boot decrypted console kernels. Its C++ source models components including Aeolia controllers and Liverpool graphics hardware, while hardware and kernel notes record device IDs, registers and kernel interfaces.

TamaLIB emulates first-generation Tamagotchi devices built around Epson E0C6S46 and E0C6S48 microcontrollers, allowing their program ROMs to run on other hardware. A host implements its hardware abstraction layer for buttons, timing, audio and the 32×16 display.

The Quansheng UV-K5 Hardware Reverse Engineering Project reconstructs the radio's V1.4 PCB as KiCad schematic and board files. The author describes measuring removed components, photographing and sanding the board to expose inner layers, and aligning those images while tracing connections.

orsala_hack reconstructs the control behavior of the IKEA ORSALA lamp in replacement STM8 firmware. It documents the original rotary-encoder actions, MCU and LED-driver connections, and changes brightness, color-temperature and power controls while saving settings to EEPROM.

stf-sharc reconstructs and annotates the two ADSP-21062 microcode images used by Sega Model 2 hardware. The assembly documents COP math commands, GEO display-list commands and FIFO exchanges; the author reports that both images reassemble byte for byte to the ROM.

F3DEX2 is a set of matching disassemblies of the Nintendo 64 F3DEX2 and F3DZEX2 RSP microcode family. Matched examples include F3DEX2 2.04 through 2.08H and F3DZEX2 2.06H, 2.08I, and 2.08J, in fifo, xbus, and No Nearclipping variants.

B3603 investigates the buck converter's control board to support replacement STM8 firmware. The project maps MCU pins, display drivers and voltage and current control signals, includes board schematics, and provides firmware that the author reports is operational and serially controllable.

SmartClock-OSS rebuilds firmware for the SD Pro Smart Weather Clock after analysis of its stock image and flash layout. The ESP8266 firmware provides seven clock faces, Open-Meteo weather, a local settings page, and recovery through power cycling; the repository records hardware observations and installation results.

The Radtel RT-890 project reimplements version 1.34 of the radio's firmware as C source to study device behavior. Its tree contains application logic, radio and peripheral drivers, board support and startup code, while the author notes that some variables and functions remain unidentified.

Macrosilicon Custom Firmware studies the 8051 mask ROM and EEPROM loading behavior of MS2107, MS2109 and MS9123 USB video chips, then builds replacement EEPROM images. Its chip notes map hooks, headers and memory addresses; host tools dump device memory and access new HID mailbox commands for status, GPIO and I2C.

Obliteration reconstructs the PlayStation 4 kernel in Rust for a custom virtualization stack intended to run dumped PS4 system software on Windows, Linux, and macOS. The author reports a working 64-bit kernel and VMM with GDT, TSS, IDT, syscall, and virtual-memory setup; development is focused on launching mini-syscore.elf.

libElysianVMU reconstructs the Sega Dreamcast Visual Memory Unit as a C17 emulator core. It models the VMU CPU, memory, display, buzzer, and flash filesystem, supports official BIOS images, and handles VMU formats including VMI, VMS, DCI, and DCM. The repository also contains instruction-set, memory-map, and file-format documentation.

Digimon V-Pet investigates the 1997 Digital Monster firmware, focusing on Ver. 1 and comparing Ver. 2. Static analysis and emulator experiments map its Epson E0C6200 program, RAM, LCD, care and battle behavior, and device link protocol. The repository includes an article, Ghidra maps and tools that generate annotated listings from a user's firmware dump.

BCM5719 Firmware Reimplementation rebuilds firmware for the Broadcom BCM5719 network controller from the Ortega specification. Its source includes MIPS boot stages, an APE NC-SI handler, NVRAM and MII libraries, plus flash and register tools. The author reports testing on Talos II and Blackbird and says the firmware handles network traffic over NC-SI.

The X-40 laser rangefinder study reconstructs the tape measure's circuit and replaces its firmware for DIY distance measurement. The author captured I2C packets with a logic analyzer, decoded modulation-frequency values and wrote firmware that processes signals with a Goertzel algorithm; PC utilities display captured data and results.

CatCard implements Rust replacement firmware for Coldcard mk3, mk4, mk5 and Q1 hardware. It documents the protected bootloader's image layout, signature and callgate ABI, then builds board-specific wallet, storage and USB components against those fixed interfaces. The author reports that device builds run, while signing and several transports remain without end-to-end device exercise.

LaiNES reconstructs NES console behavior in a cycle-level emulator. Its implementation models the 6502 CPU, PPU, audio hardware and common cartridge mappers, while technical notes describe timing the PPU at three steps per CPU cycle.

EP4CE6 Bitstream Reverse Engineering maps the proprietary .rbf configuration format of the Cyclone IV EP4CE6F17C8 FPGA. Its Python pipeline compiles controlled Verilog variants with Quartus, diffs bitstreams and records CRAM, LUT and routing mappings. The repository includes format findings and code for reading and writing bitstream features.

Powar emulates the Pokéwalker using a user-supplied ROM and EEPROM image. Its C source implements the CPU instructions used so far, EEPROM, LCD, buttons and some Timer W functions, with SDL2 builds for desktop and an Emscripten web interface. The author describes it as a prototype with major peripherals and DS connectivity unfinished.

GameCube IPL investigates the USA retail GameCube BootROM and develops replacement IPL code. The repository includes Bootstrap 1 disassembly, IPL call and function notes, boot-font research and source for parts of the boot process; the author reports several early milestones complete while menus and final ROM assembly remain open.

GoPro Metadata Format Parser maps the GPMD telemetry stream embedded in GoPro Hero 5 MP4 recordings and provides Go readers and conversion commands. The notes describe big-endian values, four-byte alignment and labels for GPS, gyroscope, accelerometer and temperature samples.

uLaunch reconstructs selected Nintendo Switch HOME Menu behavior in a customizable replacement. It launches and suspends applications, handles applets and controllers, and implements a subset of system settings; additional settings are being reversed and implemented.

uOFW reconstructs PSP kernel and hardware behavior to produce technical documentation and open source firmware. Its source tree contains kernel module implementations and headers for PSP subsystems including memory, interrupts, device control and media handling. The project describes its implementation as incomplete.

canon_cr3 maps Canon camera image files, especially the CR3 container and its CRX image structures. Its format notes describe tracks, custom tags, metadata and compression, while a Python parser inspects CR3 and CR2 files and extracts selected image parts. Separate notes describe Canon HEIF images.

qemu-esp32-wireless reconstructs ESP32 Wi-Fi and Bluetooth LE hardware behavior in QEMU to run stock ESP-IDF firmware and its wireless blobs. QEMU patches model radio events, 802.11 traffic and BLE connections; the repository also provides example firmware, capture tools and test scenarios. The author reports comparing wireless timing with ESP32 hardware over JTAG.

rpi-open-firmware implements a replacement for the Raspberry Pi's stock VPU bootcode.bin and documents the device's boot stages. Its VC4 code initializes the clock, UART, SDRAM and ARM core; an ARM chainloader then reads the FAT boot partition and loads a Linux kernel.

ESP DC1 provides replacement firmware for the Phicomm DC1 power strip after its original app service became unavailable. The project credits original-firmware extraction, PCB photographs and U7 logic analysis; its firmware provides web setup, MQTT control, electrical measurements and overload protection.

fdsboot is a 6502 disassembly of the Famicom Disk System boot ROM, split into disk I/O, PPU, joypad, timer, sound, interrupt and random-number routines with include files for the console and FDS registers. The ca65/ld65 build reassembles fdsboot.bin and compares its CRC with the original and with a second revision, 3DS and Wii VC builds, and GW and TWIN variants selected by assembler flags. It serves as a reference when disassembling Famicom Disk System titles.

gyx-decomp is a decompilation of the Casio ES PLUS GYX scientific calculator firmware, which runs on ROHM nX-U8/100 microcontrollers. Code Casio wrote in C is recovered as ANSI C that the CCU8 compiler turns into matching assembly, Casio assembly is disassembled and reworked for RASU8, and MCU startup code is recreated from files for other U8 parts. A build script compiles, links with RLU8, converts to Intel HEX and binary, and a features file switches modes and functions to build custom ROMs. Notes cover the memory model, compiler options, segment naming and link order.

vmiv emulates the View-Master Interactive Video system by decoding a captured tape video with FFmpeg, extracting the UART-style data bytes and auxiliary audio carried in the scanlines, and feeding them to an 8051 core that runs the VMI8802 ROM alongside a TMS9128 video chip model rendered with SDL2. Its notes document the mainboard chips, VDP register setup and VRAM map, the RLE sprite and tile records, and the packet layout with sequence numbers and CRC-CCITT checks. A companion dstool disassembles and reassembles the stack-based script bytecode delivered on the tape.

Reconstructs first-generation Siri Remote Bluetooth reports for Linux, decoding buttons, touch and tvOS-style gestures. The Python implementation and protocol notes distinguish measured behavior, historical reports and inferred meanings.

Implements the vendor HID configuration protocol for the GAMEKB-K17/HCY-K017 macropad. It writes key mappings, firmware macros and RGB settings, then reads them back; protocol notes separate tested commands from unconfirmed observations and other-device findings.

Implements a USB picture-transfer driver for Thermalright Vision cooler displays, with a Rust dashboard replacing the vendor display application. The documented protocol sends a header and JPEG frames, with periodic resends to prevent the device reverting to its logo.

Reuses otoscope's reverse-engineered i4season/Soulear protocol in an ESP32-C3 bridge and Python desktop viewer. The author credits Claude Code for implementation and reports streaming one Hopefox Find T to a Windows PC, with recording, orientation and LED controls.

ultimate2 reconstructs the configuration protocol for supported 8BitDo controllers and implements command-line, graphical and browser clients. Its protocol document reports using REA with Ghidra on a native DLL and ILSpy on .NET assemblies to recover HID reports and configuration records. The clients read, edit and write controller settings.

remote-me implements an Apple TV browser remote from analysis of iOS TVRemoteCore and Rapport frameworks. The author reports using REA and Ghidra to recover Companion transport, pairing, session, HID, touch, and keyboard behavior, then testing requests against an Apple TV. The project also controls LG webOS TVs through SSAP.

Attack Shark K86 reconstructs the yc3121 keyboard's HID controls from analysis of its official driver with REA. The notes describe 64-byte feature reports, checksums and commands; a Windows Electron client uses them to set lighting, per-key colours and the 240 × 135 display.

Redragon K652 macOS control reconstructs the keyboard's HID configuration protocol from decompilation of its Windows driver with REA and Ghidra. A SwiftUI app and k652ctl CLI use IOKit reports for wired lighting and key settings, while the protocol document ties fields to driver functions and records device observations. The tested model is the Azure K652GG-RGB-PRO.

AK·LINK implements Linux control of the AJAZZ AK820 Pro keyboard through its recovered wired HID commands for lighting, per-key RGB and the TFT screen. Its author documents REA-assisted investigation of a separate 2.4 GHz dongle channel, including observed usage pages, checksums and read-only probe responses; native dongle control remains in progress.

Etrel Load Guard Configurator is a Python CLI for discovering, reading and configuring Etrel Load Guard energy meters through a reconstructed UDP protocol. The author reports using REA with Ghidra on LoadGuardConfigurator.exe to recover packet fields and settings, then checking byte order and read-only measurements on a device. The tool includes dry-run writes and a simulator.

Documents an author-reported scanner investigation comparing vendor-driver USB control transfers with Linux-driver traces to infer initialization, timing and resolution parameters. The released harness organizes reference capture and comparison; it does not automatically recover a complete protocol specification.

Runs a local HTTPS and MQTT stack in place of Roborock’s cloud, so supported vacuums keep live maps and controls on an isolated network without rooting or hardware changes. The maintainer’s technical write-up recounts earlier app and traffic analysis and a later investigation in which Claude Code and Codex worked against an emulated firmware environment. Compatibility is reported per model by the project and its users.

Reimplements the client side of Apple’s private Apple Push Notification service (APNs) protocol in platform-independent Python: it activates as an Apple device, connects to the APNs courier, mints app-scoped tokens and receives push notifications. The project began as the author’s proof of concept for iMessage reverse engineering, but the current rewrite has removed IDS and iMessage support for now. It uses Apple’s services outside Apple’s official clients.

Recovers enough of the infrared protocol used by PixMob event wristbands to light them at home, starting from Flipper Zero recordings made at concerts and games and replaying them to bracelets. Pulse-timing analysis found 38 kHz signals with bit intervals of roughly 700 µs, and targeted brute forcing from an ESP32 discovered hundreds of colour, fade, random and motion-mode commands, now sent through Arduino, Python and web tools. The README calls the result far from exhaustive and points to a later repository that decoded most of the full IR protocol through MCU dumping.

Python command-line reimplementation of Apple's AirDrop protocol from SEEMOO Lab's reverse-engineering research. It finds receivers via _airdrop._tcp DNS-SD, sends binary-plist /Discover and /Ask requests over HTTPS and uploads gzip-compressed CPIO archives to exchange files with iOS and macOS. It is not affiliated with Apple.

Documents the Bluetooth Low Energy interface of Hasbro's Furby Connect toy, worked out, according to its notes, from the companion app's native library, sniffed BLE traffic and trial and error. It maps the GATT services and the command and response bytes of the toy's Nordic radio and GeneralPlus controller, covering action sequences, antenna colour, mood values, sensor reports and a hidden debug screen. fluffd, a Node.js daemon built on the noble BLE library, exposes these commands through an HTTP API and a browser control page.

Asyncio Python library and command-line tools that act as an independent client for Apple TV and AirPlay devices by reimplementing the DMAP/DACP, Media Remote Protocol, Companion Link, AirPlay and RAOP protocols, which its protocol documentation describes as reverse engineered. That page records the recovered binary formats, Zeroconf properties, the OPACK encoding, pair-setup and pair-verify exchanges and Companion commands, with some request headers taken from Wireshark captures of the iPhone Remote app, and the bundled atvproxy relays MRP, Companion and AirPlay sessions to print decrypted messages for further analysis. On this basis pyatv provides remote control, metadata with push updates, app and account switching, audio-output management and AirPlay streaming to Apple TVs, HomePods and third-party receivers.

Reimplements the Samsung Galaxy Buds Pro’s proprietary spatial-audio messages in a small Python script so that a PC can stream the earbuds’ head-tracking data in real time. It connects to the earbuds’ GEARMANAGER (or FACTORY) RFCOMM serial service, frames packets with start and end markers and a CRC16-CCITT checksum, enables the sensor stream with attach and two-second keep-alive messages, and decodes the rotation quaternion from the data events. A contributed script converts the quaternion to Euler angles and forwards it over local UDP to a Unity receiver; results are shown only as author-provided sample output.

Documents the Bluetooth Low Energy protocol between the Even app and Even Realities G2 smart glasses, worked out from captured traffic: GATT characteristic UUIDs, an 8-byte transport header with sequence, multi-packet and two-byte service-ID fields, a CRC-16/CCITT over the payload, and protobuf payloads with draft .proto definitions. A Python example built on bleak sends the seven-packet session handshake and drives the teleprompter service to show custom text. The README’s status table marks connection, handshake, teleprompter and calendar widget as working, notifications as partial, and Even AI and navigation as still under research.

Reimplements the Wi-Fi remote-control protocol of Fujifilm X-series cameras as a C++ library and an interactive command-line client that joins the camera's access point. Its headers name the control, event and JPEG live-view ports, message types and camera property codes, and source comments keep hex traces of exchanges along with what "the app" sends; the client connects, fires the shutter, records video, adjusts exposure settings and focus point, and streams live view, optionally into a Linux webcam device. README calls the tool very limited and mostly undocumented, so the protocol knowledge lives in code and comments rather than a specification.