# Reverse-engineering case studies · Page 17

> Page 17 of 21, cases 3,201–3,400. 4,025 case studies from 5,191 curated resources, with documented reconstruction methods, scope, and original evidence.

- HTML: <https://awesomerea.org/cases/page/17/>
- 简体中文: <https://awesomerea.org/zh/cases/page/17/index.md>

## Native binaries (5)

- [Forecast Channel: decompiling the Wii weather app](https://awesomerea.org/resources/forecast-channel/index.md): Case study · This decompiles the Wii Forecast Channel, version HAFE v7, USA/NTSC. The WAD is copied to orig/HAFE. python configure.py accepts --version for a version other than HAFE. ninja builds the project, and objdiff.json is written after the first successful build. Linux and macOS download wibo.
- [Xbox 360 kernel: decompiling version 17489.0](https://awesomerea.org/resources/xkrnl-decomp/index.md): Case study · This is a work-in-progress decompilation of the Xbox 360 kernel, file set 21256.18_D, kernel version 17489.0. xboxkrnld.exe has SHA-1 a303e3404e8dd0b9e9defd38aa6c37e04eb19101. xboxkrnld.pdb has SHA-1 625c54f4f273c66fd7a08e8b2ff7d1167983eeba. The image goes in orig/21256.18_D. python configure.py and ninja build it. objdiff.json appears after the first successful build.
- [PICOLOVE: reimplementing the PICO-8 API in LÖVE](https://awesomerea.org/resources/picolove/index.md): Case study · PICOLOVE implements the PICO-8 API in LÖVE so PICO-8 carts can run as LÖVE programs. The default runtime is LÖVE 11.5, and 0.10.2 and 0.9.2 are also listed. make builds it, make dev reloads in a loop, and make test runs the checks. Cartridge versions above 8 are not implemented, and the runtime uses floating-point numbers rather than PICO-8 fixed point.
- [DLSS 5 Neural Rendering: reconstructing a runtime model from DLL analysis](https://awesomerea.org/resources/dlss5-nr-reverse-engineering-case/index.md): Case study · DLSS 5 Neural Rendering reconstructs parts of NVIDIA's model from static analysis of nvngx_dlssnr.dll 310.8.0.0 shipped with NBA 2K27. It documents a 153-record weight container, a 71-block Swin/ViT structure and numerical references for selected operators. The author reports byte-for-byte agreement for one FFN operator across 24 comparisons.
- [linux-apfs-rw: reconstructing APFS support in a Linux kernel module](https://awesomerea.org/resources/linux-apfs-rw-case/index.md): Case study · linux-apfs-rw reconstructs support for Apple's APFS filesystem in a Linux kernel module using reverse-engineered format knowledge and an incomplete official specification. It mounts APFS volumes read-only by default and offers experimental writes, snapshot mounting and metadata checksum checking.

## Firmware and hardware (175)

- [ThinkPad IMX471: recovering camera tuning for Linux](https://awesomerea.org/resources/thinkpad-imx471-camera-case/index.md): Case study · Recovers selected camera-tuning structures from an Intel Windows driver package and uses them to repair Linux image capture on one ThinkPad model. Public CPFF/AIQB parsers, kernel patches and libcamera changes accompany the author’s Claude-assisted investigation and bounded before/after measurements.
- [MXQ PRO RK3229: an Android firmware investigation and Linux repurposing](https://awesomerea.org/resources/mxqpro-rk3229-rea-repurposing-case/index.md): Case study · An owner documents identifying an RK3229 TV box, investigating its stock Android ROM and repurposing it with a userspace gamepad driver and Armbian. REA assisted ADB inventory and Android-provider routing; APK analysis and device changes are reported as a mixed workflow.
- [iCSee LocalMod: a stock-firmware camera control extension](https://awesomerea.org/resources/icsee-localmod-rea-camera-case/index.md): Case study · An owner-authorized XM530V200 camera case uses REA/Ghidra to investigate native Sofia command handlers, then adds local control and Home Assistant integration while preserving stock drivers and recording. The source-only extension documents separate static, emulated-protocol and physical-device evidence.
- [nikond750: decrypting and mapping Nikon D750 firmware](https://awesomerea.org/resources/nikond750-case/index.md): Case study · Nikond750 investigates the Nikon D750 firmware image D750_0115.bin using decryption scripts, CRC checks, module extraction and Ghidra notes. The author reports recovering a three-table XOR scheme, identifying the ARM application and WLAN modules, and tracing a Wi-Fi throughput limit to the BCM43362 hardware; project instructions also include REA tooling.
- [LemonadeMirror: porting the Lululemon Mirror to mainline Linux](https://awesomerea.org/resources/lemonademirror-case/index.md): Case study · LemonadeMirror ports the Lululemon Mirror's peripherals from its Android vendor software to Debian and a mainline Linux kernel. The author describes using REA, Ghidra, objdump and device-tree decoding to recover display, audio, microphone and camera settings, then implements kernel patches, a device tree and user-space services.
- [Bose USB Bridge: selecting SoundLink Flex USB audio from firmware research](https://awesomerea.org/resources/bose-usb-bridge-case/index.md): Case study · Bose USB Bridge uses firmware and updater research to select an existing USB audio mode on a guarded SoundLink Flex unit. The macOS LaunchAgent sends scoped USB/HID requests and lets the built-in USB audio stack carry playback; its research notes report REA analysis of the updater and separate CSR filesystem and XAP firmware analysis.
- [RTX 3070 Ti VBIOS Reverse Engineering: mapping and analyzing GA104 firmware](https://awesomerea.org/resources/rtx-3070-ti-vbios-re-case/index.md): Case study · RTX 3070 Ti VBIOS Reverse Engineering documents analysis of an MSI GA104 VBIOS, covering its ROM layout, NPDE and BIT structures, x86 BIOS, compressed UEFI GOP and Falcon fuc5 microcode. Its workflow combines ROM parsers, REA with Ghidra, EfiCompress decompression, envydis and a Falcon MMIO probe; the repository includes scripts, format notes and an envydis ISA patch.
- [hantek-dso: reconstructing Hantek DSO5000P USB control](https://awesomerea.org/resources/hantek-dso5000p-linux-case/index.md): Case study · hantek-dso reconstructs USB control of Hantek DSO5000P oscilloscopes in a Linux Python client with GUI, CLI and API. Its protocol reference combines REA and Ghidra analysis of scope firmware, inspection of the original Windows Scope application and live DSO5102P tests. The client reads waveforms and settings, changes controls and retrieves screenshots over the recovered command framing.
- [flipper-telink: replacement firmware for Tuya Zigbee remotes](https://awesomerea.org/resources/flipper-telink-tuya-remote-firmware-case/index.md): Case study · A Flipper Zero app that bit-bangs Telink’s SWire debug interface to dump and reflash TLSR825x Zigbee devices, with static-analysis notes on the dumps and freshly written firmware for two of them. For Tuya TS0044/TS0046 scene remotes, the notes trace the stock ~500 ms single-click delay to a double-click window; the replacement firmware drops that window while presenting the stock model IDs to Zigbee2MQTT. The latest Zigbee build is marked unverified for pairing, actions and battery reporting.
- [Supermodel: initial Real3D Pro-1000 image-generator emulation](https://awesomerea.org/resources/supermodel-real3d-pro1000-emulation-case/index.md): Case study · Adds emulation of Real3D’s Pro-1000, the SCSI-attached image generator from which Sega’s Model 3 graphics hardware derives, to the Supermodel arcade emulator. It boots user-supplied Pro-1000 firmware from the SDK disc, emulates the board’s interrupt, JTAG and UART hardware, and exposes the firmware’s built-in monitor on the console. Nothing renders yet, and SCSI host communication is unimplemented.
- [OpenDMCUFirm: a reimplemented Wii U DMCU display firmware](https://awesomerea.org/resources/opendmcufirm-wii-u-dmcu-firmware-case/index.md): Case study · Reimplements in C the firmware of the Wii U’s DMCU, the M68HC11-compatible display microcontroller in its AMD graphics controller, which in Wii mode reads the Video Interface state and configures display output, deinterlacing, scaling and overscan. The README says the work is based on reverse engineering of the original firmware with byte-for-byte matching decompilation outside its scope, and calls it a work in progress. The built image replaces the stock firmware in Wii mode when loaded through the evWii plugin.
- [reflecticon-224: running Lexicon 224 reverb firmware on emulated hardware](https://awesomerea.org/resources/reflecticon-224-lexicon-emulation-case/index.md): Case study · Emulates the Lexicon 224, 224X and 224XL digital reverbs so that their own firmware runs in a browser page or a JUCE plugin. The repository layers KiCad schematics, gate-level and board-level Verilog models, an 8080-hosted C++ emulator and analog input/output models, and checks faster layers against slower ones using user-supplied ROMs. It is a work-in-progress hardware-and-firmware emulation whose documentation is still pending.
- [TeddyCloud: a self-hosted replacement for the Toniebox cloud](https://awesomerea.org/resources/teddycloud-toniebox-server-case/index.md): Case study · Reimplements the Boxine cloud services a Toniebox talks to as a self-hosted C server, so the box can fetch audio, settings and over-the-air content locally while the owner controls what reaches the manufacturer. It serves and caches tonie audio, converts other audio into the box’s TAF format, can pass requests through to the original cloud, and adds a web interface, MQTT and Home Assistant integration. Protobuf definitions in the repository describe the box’s freshness-check, RTNL log and TAF header messages.
- [Valetudo: local replacement for robot-vacuum vendor clouds](https://awesomerea.org/resources/valetudo-robot-cloud-replacement-case/index.md): Case study · Replaces the vendor cloud of supported robot vacuums with a local service that runs on the rooted robot beside the vendor firmware and emulates the cloud endpoints that firmware expects, including a miio dummycloud and a counterpart for Midea's MSmart protocol. Its FAQ says each new vendor backend meant reverse engineering data formats, authentication and communication without vendor documentation; Valetudo converts the proprietary map formats into one ValetudoMap format and keeps Kaitai Struct descriptions of Dreame, Roborock and Viomi map files and a Midea protobuf schema as references. It adds a web interface, a REST API with Swagger UI and MQTT/Home Assistant integration, while feature parity with the vendor apps is an explicit non-goal.
- [EchoMuse: replacement software that turns the Echo Dot 2nd gen into a Home Assistant voice satellite](https://awesomerea.org/resources/echomuse-echo-dot-voice-satellite-case/index.md): Case study · Replaces the software on an unlocked second-generation Amazon Echo Dot (2016, codename biscuit) so it works as a local Home Assistant voice satellite over the ESPHome API: EchoMuse's own Go firmware drives the microphones, speaker, LED ring and buttons, and a controller on the LAN handles wake words, devices and a dashboard. Its default emOS mode swaps Amazon's Android userspace for the project's own init and busybox while keeping the Dot's kernel from the owner's boot image. An engineering journal records how codec routes, the mute key and other hardware behavior were worked out by measuring the device and diffing the mixer and DAPM state while stock FireOS plays a sound.
- [OSIRIS: replacing Onkyo receiver firmware through MCU protocol research](https://awesomerea.org/resources/osiris-onkyo-receiver-case/index.md): Case study · OSIRIS replaces the DSP-board software of Onkyo TX-NR515 and TX-NR717 receivers with its own boot loader, Linux services and DSP code. The project documents the SPI exchange between the main MCU and DSP board, including 1032-byte transfers, frame structure and command meanings recovered from stock firmware and logs.
- [Virtual MPC Sample: rehosting Akai MPC Sample firmware in QEMU](https://awesomerea.org/resources/virtual-mpc-sample-case/index.md): Case study · Virtual MPC Sample rehosts Akai MPC Sample 1.3.0.12 firmware in QEMU using a custom lab kernel and a browser panel for the device controls. The repository documents firmware and device architecture, emulates the panel's UART communication and provides a shell, tracing and mod testing against the user's own firmware files.
- [OpenJooki: replacing the Jooki 2 software and recovery path](https://awesomerea.org/resources/openjooki-jooki2-case/index.md): Case study · OpenJooki replaces the Jooki 2 music speaker's embedded Linux core and provides phone-based control, updates and SD-card recovery. Its technical notes map the device's Ingenic Linux and ESP32 split, storage partitions, Mender update slots and recovery behavior, while the repository contains the replacement Lua services and installer tooling.
- [Stickwalker: porting Pokéwalker firmware to the Stick S3](https://awesomerea.org/resources/stickwalker-case/index.md): Case study · Stickwalker ports a matching reconstruction of Pokéwalker firmware to the M5Stack Stick S3. The repository includes firmware source, build tooling and placeholder artwork; users can build with artwork extracted from their own ROM, and a BPV10NF photodiode supplies infrared reception.
- [sony-bravia-linux: pre-Android BRAVIA platform and media behavior](https://awesomerea.org/resources/sony-bravia-linux-case/index.md): Case study · sony-bravia-linux investigates the Linux-based, pre-Android Sony BRAVIA platform and reconstructs selected media and portal behavior for owner-run services. Its documentation records observations from 2011–2012 AZ1, AZ2 and AZ3 sets, including remote input, browser media handling and 3D signalling. The repository also contains tools for H.264 3D SEI and related media workflows.
- [VanMoof BLE: a client for S5, A5 and S6 bicycle protocols](https://awesomerea.org/resources/vanmoof-ble-protocol-case/index.md): Case study · VanMoof BLE implements a Python client for the S5, A5 and S6 bicycle BLE protocols. It authenticates with an Ed25519 certificate, reads and writes documented topics, decodes captured messages, and exposes controls and telemetry according to each model's message format.
- [open-picpak: reconstructing the PicPak frame's BLE protocol and device behavior](https://awesomerea.org/resources/open-picpak-case/index.md): Case study · open-picpak documents the PicPak 4.2-inch e-ink frame's stock firmware behavior, BLE GATT protocol, and image conversion pipeline. The author reports deriving byte-level findings from the stock ESP-IDF image and a device client, then using those findings in custom ESP-IDF firmware, host tools, and a self-hosted backend.
- [Hisense AEH-W41H1: local A/C control over a reconstructed RS-485 bus](https://awesomerea.org/resources/hisense-aeh-w41h1-local-control-case/index.md): Case study · Hisense AEH-W41H1 local control replaces the air conditioner's cloud-connected Wi-Fi module with ESPHome firmware for an ESP32 board or the stock RTL8710C module. The implementation speaks the A/C's RS-485 bus and exposes climate controls and diagnostics to Home Assistant. Protocol notes describe the frame envelope, checksum, bus roles, and command/status behavior derived from device observation.
- [nRF52 e-paper tag: reconstructing an undocumented display interface](https://awesomerea.org/resources/nrf52-eink-price-tag-case/index.md): Case study · nRF52 e-paper tag reconstructs control of an undocumented electronic shelf label with an nRF52832 board and SSD1675A-class panel. The repository records the pinout, 9-bit SPI connection, waveform-table layout and refresh behavior, and provides replacement Zephyr firmware plus a portable C99 display driver.
- [moi3-cluster-pipeline-re: MOI3 instrument-cluster video pipeline](https://awesomerea.org/resources/moi3-cluster-pipeline-re-case/index.md): Case study · The MOI3 cluster pipeline study reconstructs the display path from a VW MIB3 head unit to its instrument cluster on a PC bench. It documents a Wayland ivi_share handoff, RGBA-to-YUV conversion, H.264 encoding and RTP/UDP multicast, and supplies shims and a compositor stub for running a user-provided multi-screen-server binary. Ghidra scripts and a protocol extractor support the investigation.
- [openwrt-dlink-dir842-r1: OpenWrt port informed by Realtek datapath research](https://awesomerea.org/resources/openwrt-dlink-dir842-r1-case/index.md): Case study · openwrt-dlink-dir842-r1 ports OpenWrt to the D-Link DIR-842 R1 using a pinned base checkout and device-specific overlays. Its engineering notes investigate the RTL8197F and RTL8367S network path, switch setup and hardware NAT, while the build produces RAM-boot and NOR-flash firmware images.
- [ZOOM F8: BLE remote-control protocol reconstruction](https://awesomerea.org/resources/zoom-f8-ble-protocol-case/index.md): Case study · ZOOM F8 BLE protocol documentation reconstructs remote control for F8-family field recorders. It describes advertising, GATT handles, the connection handshake, commands, telemetry, settings and SD-card browsing, while distinguishing live observations from firmware-derived and inferred details.
- [UAD-2 OCTO: tracing PCIe command rings and DSP resource loading](https://awesomerea.org/resources/uad2-octo-pcie-case/index.md): Case study · UAD-2 OCTO-RE investigates the PCIe host transport of a Universal Audio DSP card through driver analysis and experiments on one Rev 5 board. The author reports reproducing command-ring and DMA startup across eight DSPs and recovering parts of the firmware and Bill resource containers. General-purpose DSP execution remains blocked by an unresolved runtime response and opaque payload format.
- [GameSir Cyclone 2: firmware findings and controller bridge](https://awesomerea.org/resources/gamesir-cyclone2-case/index.md): Case study · GameSir Cyclone 2 documents analysis of the controller’s JieLi BR23 firmware, including image layout, instruction encodings, timer behavior and firmware patches. It also describes a Raspberry Pi bridge that maps Bluetooth HID input to an Xbox 360 Wireless Receiver USB interface for Windows XInput.
- [airport-express-tools: rebuilding AirPort Express configuration and Wi-Fi client mode](https://awesomerea.org/resources/airport-express-tools-case/index.md): Case study · airport-express-tools reconstructs configuration and Wi-Fi client functions for the second-generation AirPort Express A1392 from firmware and ACP protocol research. Its Python CLI configures Wi-Fi, connection sharing and device settings; a local web UI provides Wi-Fi and device controls. A replacement supplicant joins WPA2 networks. Reference pages map ACP properties, RPCs, firmware contents and client-mode behavior, with Ghidra and unpacking helpers.
- [Gaomon M10K 2018: firmware decoding and report-rate investigation](https://awesomerea.org/resources/gaomon-m10k-2018-firmware-case/index.md): Case study · Gaomon M10K 2018 research decodes a substitution-encoded GD32F350 tablet firmware image and investigates its sensor loop and USB report path. The repository includes an image codec, constrained patch builder, DFU transaction documentation, and observations from experimental report-rate changes.
- [nokia105-emu: Nokia 105 firmware emulation](https://awesomerea.org/resources/nokia105-firmware-emulation-case/index.md): Case study · nokia105-emu runs a Nokia 105 TA-1423 firmware dump from boot ROM to a usable menu interface. Unicorn emulates the ARM926EJ-S CPU, while Python modules model the SC6531E interrupt controller, flash, display, keypad, power management and other peripherals based on firmware behaviour. The user supplies the phone’s own flash and boot ROM images.
- [Hisense VIDAA (MT9603): firmware and local bridge findings](https://awesomerea.org/resources/hisense-vidaa-mt9603-case/index.md): Case study · Hisense VIDAA (MT9603) records an investigation of a TV firmware container and browser-facing local services. The notes map the phoenix:// message format, its WebSocket and HTTP transports, a 96-function bridge and permission checks, with sanitized probe outputs. The author reports that the encrypted firmware payload remained inaccessible.
- [WebTV PTL: documenting the set-top box listings format](https://awesomerea.org/resources/webtv-ptl-format-case/index.md): Case study · WebTV PTL documents the binary television-listings database used by WebTV Plus and DishPlayer set-top boxes. The write-up describes its location on device storage, big-endian integer encoding, versioned header, block layout and footer.
- [SL-GlassesLed26x7: LED matrix pin mapping and replacement driver](https://awesomerea.org/resources/sl-glassesled26x7-case/index.md): Case study · SL-GlassesLed26x7 documents the connections of a 26×7 charlieplexed LED-glasses matrix and drives it with an ESP32 in place of the original controller. The repository records its pin layout and LED sections, with Arduino display examples and a bitmap generator.
- [FIFINE SC3: firmware decryption and four-fader patch](https://awesomerea.org/resources/sc3-firmware-research-case/index.md): Case study · FIFINE SC3 research documents decryption of the mixer's MVsilicon firmware and its ACP control protocol over USB HID. The repository provides cipher and container tooling, protocol findings, and a firmware patch that exposes all four fader positions to host-side volume tools.
- [HHKB Professional Classic: vendor HID and firmware investigation](https://awesomerea.org/resources/hhkb-professional-classic-case/index.md): Case study · HHKB-reverse-engineering investigates the vendor USB HID protocol of the HHKB Professional Classic keyboard. It documents 64-byte request and response frames, command behavior, keymap layouts and firmware-dump behavior, with macOS IOKit tools for probing and changing keymaps.
- [nano3-os: reconstructing the Avalon Nano 3 mining protocol](https://awesomerea.org/resources/nano3-os-miner-protocol-case/index.md): Case study · nano3-os reconstructs the Canaan Avalon Nano 3's K230-to-K210 mining protocol from analysis of btcminer and UART captures. Its notes cover CN frames, CRC-16/XMODEM, job bursts and nonce reports; a Go daemon uses that protocol to run the miner with a Stratum V1 pool, board controls and a web dashboard.
- [gear360-raw: recovering RAW capture and calibration from the Gear 360 SM-R210](https://awesomerea.org/resources/gear360-raw-case/index.md): Case study · gear360-raw investigates the Samsung Gear 360 SM-R210 camera's capture firmware and calibration data to enable 12-bit Bayer RAW shooting. SD-card mod files trigger sensor dumps, while Python tools convert them to DNG using camera color data and stitch images using the decoded per-unit lens model; command and safety notes document the underlying behavior.
- [Minager: reconstructing Antminer control interfaces](https://awesomerea.org/resources/minager-case/index.md): Case study · Minager builds a remote monitoring and control client for Antminer ASIC hardware from reconstructed CGI interfaces. Its Go code maps device responses into typed structures and uses Telegram menus for statistics, pool changes, power modes and alerts; the author also reports firmware and packet analysis.
- [chave-sandeiro: investigating the Renault Sandero turn-signal switch](https://awesomerea.org/resources/chave-sandero-case/index.md): Case study · chave-sandeiro documents an investigation of the Renault Sandero turn-signal switch through connector, interior and schematic images. An accompanying Arduino sketch reads turn-signal and headlight inputs from digital pins and prints state changes over serial.
- [f407 大绿板: display and button pin mapping](https://awesomerea.org/resources/f407-board-demo-case/index.md): Case study · The f407 大绿板 investigation maps the pins connecting an ST7735S display module and five onboard buttons to an STM32F407VET6 development board. It provides display and GPIO probe programs, the author's reported pin assignments and a combined display-and-button demo.
- [Dell Precision A34: mapping SMBIOS tokens to BIOS setup fields](https://awesomerea.org/resources/dell-precision-a34-tokens-case/index.md): Case study · A Dell Precision Tower 5810 and 7810 BIOS A34 investigation maps SMBIOS DA tokens to Dell setting IDs and AMI Setup bytes. It publishes per-model token tables, setting and token maps, setup-form options, and read-only token and byte-scanning tools. The author reports checking selected mappings against live reads and an NVRAM change.
- [Earbud-case LED display: a probed pinout and segment map](https://awesomerea.org/resources/earbud-led-display-map-case/index.md): Case study · The earbud-case LED display study reconstructs the pinout and electrical drive map of an unmarked charging-case display. It documents 31 segments on eight charlieplexed lines, including ribbon-finger wiring and anode/cathode combinations, and supplies an ESP32-C3 driver and serial probing sketch.
- [TCL AC Original Module ESPHome: reconstructing WL6U air-conditioner control](https://awesomerea.org/resources/tcl-ac-original-module-esphome-case/index.md): Case study · TCL AC Original Module ESPHome reconstructs local control of a TCL air conditioner on its original WL6U Wi-Fi module. The author traced command building and status decoding in a stock RTL8720CF firmware dump, compared selected functions with replacement codecs, and implemented ESPHome controls and readings over the module's UART link.
- [EKIY / Melis reverse engineering: emulating display firmware and decoding UI resources](https://awesomerea.org/resources/ekiy-melis-re-case/index.md): Case study · EKIY / Melis reverse engineering runs the original home-screen firmware of an Allwinner F133-B display in a TypeScript application-level emulator. It documents the observed DATAV1.0 UI format, provides tools to read and rebuild UI packages, and records firmware-specific modification findings using a dump supplied by the user.
- [vfs495-driver: a Linux driver from fingerprint-reader protocol research](https://awesomerea.org/resources/vfs495-driver-case/index.md): Case study · vfs495-driver implements a Linux libfprint TOD driver for the Validity VFS495 swipe fingerprint reader. Its documented research traces the sensor's USB handshake, encrypted command and image streams, and firmware patch setup; a build recipe extracts required command data from the user's HP SoftPaq download.
- [Potensic ATOM: reconstructing the DSRC02A controller cable](https://awesomerea.org/resources/potensic-atom-usb-c-replacement-cable-case/index.md): Case study · The Potensic ATOM cable investigation reconstructs the directional USB-C connection between a DSRC02A drone controller and an Android phone. Multimeter measurements inform an editable KiCad schematic, wiring notes and a replacement adapter design using SBU/CC connections and two 56 kΩ resistors. The author reports one prototype carrying video and controller input during a short flight.
- [YBX ESP32 System Emulator: reconstructing e-ink reader hardware in QEMU](https://awesomerea.org/resources/ybx-esp32-emulator-case/index.md): Case study · YBX ESP32 System Emulator reconstructs selected hardware behavior so original ESP32-S3 and ESP32-C3 e-ink reader firmware can run in QEMU. Its patches and host tools model display and touch paths, capture panel framebuffers, and record boot, peripheral and navigation experiments for YBX X4 Pro and CrossPoint images.
- [Frontier FS2340: investigating Majority Touro radio firmware](https://awesomerea.org/resources/frontier-fs2340-firmware-case/index.md): Case study · A firmware investigation of a Majority Touro radio on the Frontier Venice X/FS2340 platform maps compressed update blocks, menu and language tables, graphics, bootloaders and recovery paths. Offline Python tools parse owner-supplied firmware and extract resources; the author reports recovery of one affected unit.
- [Contax N Digital: reconstructing a CCD Parameter Disc](https://awesomerea.org/resources/contax-n-digital-ccd-disc-case/index.md): Case study · The Contax N Digital CCD Parameter Disc recreator rebuilds a camera-specific calibration disc from newly captured RAW dark and white frames. It derives white balance, defective-pixel and reference-image files, then combines them with colour matrices and tone curves extracted from another N Digital disc. The author reports comparison with a known disc but notes unresolved factory scaling details.
- [Fosi Audio MD3: mapping the DAC and replacing its controller firmware](https://awesomerea.org/resources/fosi-md3-case/index.md): Case study · fosi-md3 investigates the Fosi Audio MD3 USB DAC and implements replacement firmware for its ESP32-S3 controller. Its notes map the USB mux, DAC I2C control, Savitech link and stock settings record from hardware observation and firmware disassembly; the ESP-IDF implementation preserves audio control and photo storage. The author reports testing on one unit.
- [dataflash-re: reconstructing the Dataflash LWR lighting protocol](https://awesomerea.org/resources/dataflash-re-case/index.md): Case study · dataflash-re reconstructs the LWR control protocol used by Lightwave Research Dataflash xenon strobes. It combines 8051 fixture firmware disassembly, schematics and controller captures to document 9-bit serial frames, then implements an ESP32 bridge from Art-Net, sACN and TouchOSC to the original RS-485 link.
- [opal-c1-revive: mapping the Opal C1 firmware and restoring camera controls](https://awesomerea.org/resources/opal-c1-revive-case/index.md): Case study · opal-c1-revive investigates the Opal C1 webcam's Myriad X hardware, 32 MB NOR flash and DepthAI pipeline. It documents the bootloader and app package, supplies scripts to back up flash and edit the pipeline, and provides a macOS menu-bar app for standard UVC controls.
- [Spirit Halloween Remote: decoding Multi-Prop radio commands](https://awesomerea.org/resources/spirit-halloween-remote-nrf24-case/index.md): Case study · Spirit Halloween Remote documents radio messages recovered from a Spirit Multi-Prop remote and replays four captured commands through a Raspberry Pi nRF24L01+ transmitter. The protocol notes give the 250 kbit/s setting, channel, address and 22-byte command bodies; an optional Home Assistant bridge exposes trigger buttons.
- [Thecus N7510: reconstructing front-panel control on Linux](https://awesomerea.org/resources/thecus-n7510-linux-case/index.md): Case study · Thecus N7510 on modern Linux restores the NAS front-panel LCD, buttons, fans and LEDs with Python daemons. The investigation images the original firmware DOM, traces and disassembles its agent2 daemon, then documents serial frames exchanged with the ATmega168 panel controller and maps board pins. The author reports testing on one N7510.
- [a2854-siri-remote-linux: reconstructing Siri Remote BLE and IR controls](https://awesomerea.org/resources/a2854-siri-remote-linux-case/index.md): Case study · a2854-siri-remote-linux reconstructs Apple Siri Remote A2854 button and voice notifications for a Linux bridge that reads btmon output. It documents GATT button values, a 100-byte Opus audio wrapper, and an IR provisioning sequence observed through HID reports; separate research examines the remote's flash image and IR database.
- [HDF / HarmonyOS: mapping driver IPC and Linux userland compatibility](https://awesomerea.org/resources/hdf-harmonyos-reverse-case/index.md): Case study · The HDF / HarmonyOS investigation maps the Driver Foundation's user-to-kernel IPC path and tests selected HarmonyOS libraries on Linux. It records the HDF_WRITE_READ ioctl, HdfWriteReadBuf layout and I2C command IDs, supported by harness code, a kernel stub and QEMU experiment logs.
- [MK Typist research: mapping a keyboard and its bootloader](https://awesomerea.org/resources/mk-typist-research-case/index.md): Case study · MK Typist research maps the Mechanical Keyboards MK Typist keyboard and its stock firmware while developing a QMK port. The notes cover its Holtek HT32F52352 board, flash layout, Cheng Yong IAP boot flow, USB identities, update behavior, pinout and captured command output from one unit.
- [Huawei MUT Unbrick Tool: reconstructing router multicast recovery](https://awesomerea.org/resources/huawei-mut-unbrick-tool-case/index.md): Case study · Huawei MUT Unbrick Tool reimplements the multicast firmware upgrade exchange used by HuaweiMUT.exe for router recovery. Its Python GUI and CLI send documented UDP packet types with firmware chunks and INI metadata; research notes record findings from the original utility. The author reports that secure boot prevents software recovery on several listed models.
- [Tizen T-KTS firmware research: mapping the VDFS4 filesystem](https://awesomerea.org/resources/tizen-kts-research-case/index.md): Case study · Tizen T-KTS firmware research maps the VDFS4 filesystem inside a decrypted Samsung smart TV firmware image. Its notes describe superblocks, catalog records, file extents and copy-on-write block translation, while Python tools enumerate entries and locate file data. The author reports 2,113 enumerated entries; payload decompression remains unresolved.
- [Philips Avent: reconstructing SCD923/26 local communication](https://awesomerea.org/resources/philips-avent-local-protocol-case/index.md): Case study · Philips Avent Local Protocols investigates the SCD923/26 baby monitor's QR pairing, encrypted control session, RTSP video and separate ADPCM audio channels. The study combines handheld firmware analysis, isolated ARM emulation and tests against a paired baby unit. It marks discovery behavior and SCD973 authentication as unresolved.
- [igpsport-binavi-poi: reconstructing BiNavi route points](https://awesomerea.org/resources/igpsport-binavi-poi-case/index.md): Case study · igpsport-binavi-poi reconstructs the iGPSPORT BiNavi's .cnx route track codec and POI type values. Its Python generator combines a GPX track with distance-indexed roadbook points into a device route that shows proximity reminders during navigation; technical notes document the XML layout and observed FIT behavior.
- [es4308cfg: reconstructing the Edgecore ES4308-PoE config format](https://awesomerea.org/resources/es4308cfg-case/index.md): Case study · es4308cfg reconstructs the Edgecore ES4308-PoE switch's proprietary NVRAM configuration format from differential exports. The repository documents TLV framing, checksums, obfuscated strings and port-bit permutations, and provides Rust and Python codecs, a Kaitai specification and sanitized fixtures.
- [microfreak-emu: rehosting Arturia MicroFreak firmware in Renode](https://awesomerea.org/resources/microfreak-emu-case/index.md): Case study · microfreak-emu rehosts Arturia MicroFreak firmware 5.0.0.2084 in Renode with models for STM32 peripherals and audio output. Its research documents firmware addresses, stored formats and the SysEx message exchange, while the harness supports boot checks, MIDI-driven differential runs and preset rendering.
- [Ledger Nano X board map: tracing and reconstructing the main board](https://awesomerea.org/resources/ledger-nano-x-board-map-case/index.md): Case study · Ledger Nano X board map reconstructs the hardware wallet's main board from photos, tracing 40 test pads, copper nets and components into a KiCad project. Photo and 3D viewers expose the mapped connections, while scripts regenerate the board and schematic from the recorded data.
- [Pulsar II: reconstructing Linux support from Windows SCOPE analysis](https://awesomerea.org/resources/sonic-core-pulsar-ii-linux-driver-case/index.md): Case study · The Pulsar II project reconstructs Linux support for the Creamware/Sonic Core DSP sound card from analysis of scScope.sys and Sim2k.dll. Its kernel module, loader, and SCOPE file decoders handle card initialization, DSP modules, audio streams, and device files; reports document register and boot behavior.
- [Z80 NMOS Silicon-to-RTL CPU Core: reconstructing transistor logic in Verilog](https://awesomerea.org/resources/z80-silicon-rtl-case/index.md): Case study · Z80 NMOS Silicon-to-RTL CPU Core reconstructs the Zilog NMOS Z80 processor as synchronous Verilog from a transistor-level netlist and successive logic schematics. The author reports testing a Verilator model with Z80 software suites in EmuStudio.
- [miband11-watchface-maker: reconstructing the Smart Band 11 .face format](https://awesomerea.org/resources/miband11-watchface-maker-case/index.md): Case study · miband11-watchface-maker reconstructs the .face watch-face package format for Xiaomi Smart Band 11 by comparing inputs and outputs of the official compiler. Its format specification covers headers, metadata, indexes, embedded Lua and image data. Python, Java and JavaScript implementations assemble watch faces from media inputs.
- [fb200-tools: reconstructing FLAMMA FB200 firmware and control protocols](https://awesomerea.org/resources/fb200-tools-case/index.md): Case study · fb200-tools reconstructs the FLAMMA FB200 bass pedal's firmware behavior and USB HID/BLE controls in replacement firmware and device utilities. Its research documents the stock .mr image, command framing, DSP parity work, presets, and update path; the author reports testing selected features on a physical pedal.
- [Orion Unchained: reconstructing Acer Predator Orion lighting control](https://awesomerea.org/resources/orion-unchained-case/index.md): Case study · Orion Unchained reconstructs Acer Predator Orion desktop lighting control for Linux through a kernel driver, command-line client and desktop app. Its investigation documents PredatorSense lighting payloads, the firmware's AcerGamingFunction WMI methods and the SMBus controller path; the driver uses those findings to set and read lighting effects on the tested PO7-660.
- [p2afan: mapping ASPEED BMC fan control through the P2A bridge](https://awesomerea.org/resources/p2afan-case/index.md): Case study · p2afan investigates the Tyan FT77C-B7079 BMC and controls its ASPEED AST2400 fan PWM registers from the host through the PCIe-to-AHB bridge. Its write-up maps BAR1, the PWM block and firmware layout, while the Python controller computes duty from IPMI, hwmon or command output.
- [Cisco CP-9951 DOOM: mapping phone input for a native game port](https://awesomerea.org/resources/cisco-9951-doom-case/index.md): Case study · Cisco CP-9951 DOOM ports the game to run on the IP phone's ARM CPU using its local framebuffer, keypad, and media path. The accompanying investigation maps the Raven keypad path and a 16-byte input event format from the phone's keyhandle module and hardware observations.
- [Zeppelin Air: reconstructing USB firmware recovery](https://awesomerea.org/resources/zeppelin-air-recovery-case/index.md): Case study · Zeppelin Air Recovery reconstructs the Bowers & Wilkins speaker's USB recovery procedure from its updater library and live DFU exchanges. A Python tool implements vendor commands, flashes the MCU and coprocessor in two phases, and polls the coprocessor until it is ready; protocol notes document the message sequence and flash layout.
- [EmuWorks: emulating NumWorks N0110 calculator hardware](https://awesomerea.org/resources/emuworks-case/index.md): Case study · EmuWorks recreates the NumWorks N0110 calculator's hardware environment in Renode so ARM Cortex-M7 firmware runs on an emulated STM32F730. Its peripheral models cover the ST7789V display, keyboard matrix, battery ADC and CRC unit, while a Windows app presents the screen and firmware tools. Original Core and Code firmware images are bundled; other firmware is supplied by the user.
- [CH899: reconstructing the clock's MM32–ESP exchange](https://awesomerea.org/resources/chouchin-ch899-firmware-case/index.md): Case study · CH899 firmware research reconstructs the UART exchange between the clock's MM32 movement controller and ESP8285 Wi-Fi module. It records wake, time and reset messages from stock behavior and implements replacement ESP firmware that adds Wi-Fi setup and timekeeping options while retaining the original movement controller.
- [telink-usb-ota: reconstructing Telink USB-HID firmware updates](https://awesomerea.org/resources/telink-usb-ota-case/index.md): Case study · telink-usb-ota reconstructs Telink's USB-HID OTA update exchange as a Rust Linux host tool for querying and flashing a CIDOO V65 v2 keyboard. Its protocol notes specify 33-byte HID reports, START and FINISH opcodes, 16-byte data chunks, CRC-16/MODBUS and the next-chunk acknowledgement rule, derived from updater and firmware disassembly and checked by the author against hardware.
- [K2 OpenKlipper: reconstructing the Creality K2 control stack](https://awesomerea.org/resources/k2-openklipper-case/index.md): Case study · K2 OpenKlipper rebuilds the Creality K2 printer control stack around upstream Klipper and open Python modules. Its implementation covers the strain-gauge probe, CFS filament box, closed-loop motors and touchscreen; protocol notes draw on observed printer traffic and behavior.
- [ThinkCentre Fan Control: recovering fan telemetry and modes from the M70t Gen 6](https://awesomerea.org/resources/thinkcentre-fan-control-case/index.md): Case study · ThinkCentre Fan Control uses findings from M70t Gen 6 embedded-controller probing and ACPI table analysis to show fan RPM and offer firmware fan modes. The Windows tray app reads the EC tachometer through PawnIO, obtains per-core temperatures from CPU registers and changes supported modes through Lenovo WMI.
- [strix-890m-macos: investigating Radeon 890M display bring-up](https://awesomerea.org/resources/strix-890m-macos-case/index.md): Case study · strix-890m-macos investigates Radeon 890M display bring-up on an ASUS GA403WM running macOS. Trace notes, IOAccelerator ABI data, Metal and Vulkan probes, and experimental kexts cover framebuffer adoption, OLED brightness and WindowServer attachment; accelerated graphics remain unfinished.
- [Twin Famicom: reconstructing the console power board](https://awesomerea.org/resources/twin-famicom-case/index.md): Case study · Twin Famicom reconstructs the Sharp console's power board as a KiCad schematic and PCB design based on visual inspection and measurement of an original unit. The repository contains the power-board project and states its hardware-design license.
- [EasyRazer: reconstructing Razer analog keyboard controls](https://awesomerea.org/resources/easyrazer-keyboard-case/index.md): Case study · EasyRazer reconstructs direct controls for Razer analog keyboards in a Windows Synapse replacement. Its Rust and Tauri application manages actuation, remapping, profiles and lighting, with model-specific documentation of keyboard protocol and firmware behavior.
- [Sisu DCP-3: reconstructing Nokia 3210 firmware behavior](https://awesomerea.org/resources/sisu-dcp-3-case/index.md): Case study · Sisu DCP-3 recreates the Nokia 3210 NSE-8 v6.00 experience as new C firmware for a replacement Rev B2 mainboard. It uses original-firmware analysis to guide behavior and presentation, while documented ROM research reconstructs the battery gauge; fonts, tones and other Nokia-derived assets are generated locally from the user's firmware copy.
- [vxp: reconstructing VideoNow disc playback and branching](https://awesomerea.org/resources/vxp-videonow-case/index.md): Case study · vxp reconstructs VideoNow XP player behavior by decoding picture, audio and interactive branch data from disc images. Its .NET player handles XP, Color and original black-and-white discs; a headless CLI inspects, verifies, exports and graphs disc contents.
- [Zamphenom: running Kemper Profiler firmware in a DSP emulator](https://awesomerea.org/resources/zamphenom-case/index.md): Case study · Zamphenom runs Kemper Profiler firmware in an instruction-level Motorola DSP56720 emulator and exposes its audio through a VST3 plugin. The repository includes update-file unpacking, DSP bootstrap extraction and rig-to-message-stream tools; the author reports a working amp path and delay stomp.
- [Marstek Offline Endpoint: reconstructing Venus cloud replies](https://awesomerea.org/resources/marstek-offline-endpoint-case/index.md): Case study · Marstek Offline Endpoint recreates the telemetry upload and time replies expected by Marstek Venus E and D batteries on a local server. The author traces firmware conditions behind network resets, implements the response path in a container and records uploaded measurements locally. The author reports that a Venus D on Control firmware v150 stopped its periodic network interruptions during the documented observation.
- [ZTE ZXSLC SR1010: analysing configuration and NAND firmware](https://awesomerea.org/resources/zte-sr1010-research-case/index.md): Case study · An investigation of the ZTE ZXSLC SR1010 maps its NAND partitions, encrypted rootfs, boot and upgrade paths, and config.bin format. Python tools inspect, decrypt, edit and repack owner-supplied configurations and extract firmware components.
- [esphome-quietcool: reconstructing QuietCool fan radio control](https://awesomerea.org/resources/esphome-quietcool-case/index.md): Case study · esphome-quietcool reconstructs QuietCool fan control over a proprietary 433.92 MHz 2-FSK radio link. Its ESPHome C++ component sends OEM-compatible commands, receives fan status and exposes controls through Home Assistant; the protocol work draws on SDR captures and analysis of two handheld remote firmware dumps.
- [QuietCool ESPHome: reconstructing IT-AF-SMT BLE control](https://awesomerea.org/resources/quietcool-esphome-native-case/index.md): Case study · QuietCool ESPHome replaces firmware on the IT-AF-SMT attic-fan controller and reimplements its stock BLE interface so the vendor app can still control the hub. Its protocol reference draws on analysis of the OEM firmware, Android app, and live BLE captures, while the new firmware adds Wi-Fi and Home Assistant control.
- [ReadyNAS RN426: reconstructing front-panel control under TrueNAS](https://awesomerea.org/resources/truenas-rn426-panel-case/index.md): Case study · The ReadyNAS RN426 panel project reconstructs front-panel control from NETGEAR's stock firmware so the LCD and navigation buttons work under TrueNAS SCALE. Its Python driver bit-bangs the SSD1305-class display through Denverton GPIO registers and reads button state from an MSP430 over SMBus when its interrupt fires.
- [Dahua IP cameras: mapping the device JSON-RPC API](https://awesomerea.org/resources/dahua-rpc-api-case/index.md): Case study · The Dahua IP camera and NVR investigation maps device JSON-RPC endpoints, request structure and two-step authentication from internal JavaScript. Module references cover control, configuration, media, events and maintenance methods, with a Python script for login and method discovery.
- [GNR-SMU: mapping Ryzen SMU telemetry and controls](https://awesomerea.org/resources/gnr-smu-case/index.md): Case study · GNR-SMU maps undocumented AMD Ryzen SMU power-management tables through hardware measurements, load experiments and Linux sensor comparisons. It publishes model-specific field maps and Linux telemetry tools, with guarded controls for Granite Ridge CPUs and read-only telemetry for the Vermeer 5600X.
- [SACD daemon reconstruction: rebuilding Sony BDP-BX510 sacd_extract_160](https://awesomerea.org/resources/sacd-daemon-reconstruction-case/index.md): Case study · SACD daemon reconstruction rebuilds Sony BDP-BX510's ARM sacd_extract_160 daemon in C. It documents TCP 2002 sector requests and the CPSA ioctl path, and supplies function-diff tools, QEMU device models and differential captures. The author reports 388 of 390 functions equivalent and byte-identical wire behavior in tested cases.
- [Holy Stone H120D: reconstructing drone Wi-Fi control and video traffic](https://awesomerea.org/resources/h120d-protocol-case/index.md): Case study · Holy Stone H120D research maps the drone’s Wi-Fi command, camera and video exchanges using APK decompilation, packet captures and ARM library disassembly. It documents UDP 8080 control frames, UDP 8088 camera commands and H.264 video on TCP 8888, with Python clients and an Arduino controller sketch.
- [Nokia E7-00 Linux: reconstructing the boot chain and device interfaces](https://awesomerea.org/resources/nokia-e7-00-linux-case/index.md): Case study · Nokia E7-00 Linux investigates the phone's boot chain and hardware interfaces to build QEMU models and a Linux port. Its notes cover NLoader, OneNAND, GPIO, display transport, USB and memory-card control, supported by probe outputs and kernel code. The author reports a Linux shell in emulation while physical-device bring-up remains in progress.
- [CTS Strasbourg Ticket Reader: mapping SRI512 ticket memory](https://awesomerea.org/resources/cts-strasbourg-reader-case/index.md): Case study · CTS Strasbourg Ticket Reader maps the SRI512 memory used by Strasbourg CTS paper tickets and provides a C utility to read and decode it through libnfc. The documented fields include ticket type, validity counter, validator ID and last-validation time.
- [Chronos Revived: an Android client for the recovered smart disc BLE protocol](https://awesomerea.org/resources/chronos-revived-case/index.md): Case study · Chronos Revived replaces the discontinued Android companion app for the Chronos smart disc using its recovered Bluetooth LE protocol. It handles notifications, steps, battery status and gestures, and can flash firmware supplied from the user's original APK. The protocol notes map GATT services, status bits, commands and device hardware identified from firmware analysis.
- [PS2 Floating-point: reconstructing console arithmetic behavior](https://awesomerea.org/resources/ps2-floating-point-case/index.md): Case study · PS2 Floating-point reconstructs aspects of PlayStation 2 floating-point behavior in Rust using console experiments as a baseline. Its Ps2Float type represents the console's floating-point variant and implements addition and subtraction, with test cases for ordinary values and special cases.
- [CD Changer Robot: rebuilding a Nistec ALW-501 controller](https://awesomerea.org/resources/cd-changer-robot-case/index.md): Case study · CD Changer Robot reconstructs control of a Nistec ALW-501 disc robot after tracing its motor-driver board. The repository supplies a pin map, circuit drawing, Arduino replacement firmware, Python control and imaging scripts, and mechanical parts for bulk CD transfer.
- [open-ssd: reconstructing SM2263XT SSD initialization](https://awesomerea.org/resources/open-ssd-sm2263xt-case/index.md): Case study · open-ssd reconstructs an initialization workflow for Silicon Motion SM2263-family SSDs. Its Python tool generates parameters, scans bad blocks, packages firmware and writes NAND system areas; accompanying documents map controller commands and JMS583 bridge passthrough behavior. The author identifies one tested SM2263XT, YMTC NAND and JMS583 combination.
- [t2-cruise: reconstructing Apple SMC power-limit behavior on Linux](https://awesomerea.org/resources/t2-cruise-case/index.md): Case study · t2-cruise reconstructs how a T2 MacBook's Apple SMC requests CPU and GPU power limits. The author compared SMC readings under macOS and Linux, mapped MSLC and MSLG limit steps, and wrote a Linux daemon that applies them through intel_pstate and an optional Radeon power cap.
- [XENO: reconstructing the Xbox 360 boot chain in a low-level emulator](https://awesomerea.org/resources/xeno-xbox-360-case/index.md): Case study · XENO reconstructs Xbox 360 boot behavior in a low-level emulator informed by boot-chain research and disassembly. Its Rust Xenon PowerPC core models memory, the SMC and security engine, while supporting tools analyze boot stages and XEX files. The author reports execution through the CD handoff and hypervisor guest idle state; later system components remain in progress.
- [rytm-fw-re: reconstructing Analog Rytm MKII firmware](https://awesomerea.org/resources/rytm-fw-re-case/index.md): Case study · rytm-fw-re analyses the Elektron Analog Rytm MKII OS 1.74 update and builds a freestanding ColdFire replacement firmware wrapped as a flashable .syx file. Its Ghidra probes and notes cover the ELE3 container, bootstrap entry contract, memory map, display byte protocol and flash path. The author reports that the current replacement boots and displays a test pattern.
- [Nokia DCT Platform Emulation: reconstructing early handset hardware behavior](https://awesomerea.org/resources/nokia-dct-platform-emulation-case/index.md): Case study · Nokia DCT Platform Emulation reconstructs firmware-facing hardware behavior of early Nokia phones in MAME, with the 3210 as its reference handset. Its investigation maps registers, buses, DSP mailboxes, SIM exchanges and storage behavior using static and runtime observations. The repository includes disassembly helpers, Ghidra scripts, symbol maps and subsystem reports; the author reports an interactive 3210 desktop under a modeled profile.
- [ambit-firmware: mapping Palette hardware for replacement firmware](https://awesomerea.org/resources/ambit-firmware-case/index.md): Case study · ambit-firmware develops alternative firmware for Palette devices using mapped AT90USB1286 pin connections. The hardware notes identify links to magnetic ports, I2C lines, LEDs and flashing headers; the firmware implements USB CDC control, basic LEDs and a failsafe bootloader path. Its roadmap lists display control and component communication as unfinished.
- [perfectcharge_remote: reconstructing the Waeco PerfectCharge remote PCB](https://awesomerea.org/resources/perfectcharge-remote-case/index.md): Case study · perfectcharge_remote reconstructs the Waeco PerfectCharge marine charger remote's schematic and single-layer PCB in KiCad. The design records its pushbutton, LEDs and two top-side jumper wires, with Gerber and Excellon manufacturing files alongside the KiCad files.
- [Sony A7 III: firmware updater packaging and UFU container analysis](https://awesomerea.org/resources/sony-a7m3-firmware-analysis-case/index.md): Case study · Sony A7 III firmware analysis maps the packaging of Update_ILCE7M3V404.exe from a Packman self-extractor through an inverted MSCF CAB to a UFU TLV container. The write-up records offsets, tags and CRC coverage, and a Python script reproduces extraction and structural checks. The FDAT firmware body remains encrypted.
- [Capybara: reconstructing Sonix hardware for Tamagotchi Paradise firmware](https://awesomerea.org/resources/capybara-tamagotchi-paradise-case/index.md): Case study · Capybara reconstructs the Sonix SNC73410 hardware environment needed to run Tamagotchi Paradise factory firmware on a computer. Its Rust emulator implements an ARMv7-M core and peripherals modeled from measurement, imports a user-owned 16 MB flash dump and derives the dump's decryption value before booting it.
- [ry5088-flasher: reconstructing a magnetic keyboard's HID-DFU path](https://awesomerea.org/resources/ry5088-flasher-case/index.md): Case study · ry5088-flasher reconstructs the USB HID-DFU update path used by RongYuan RY5088 magnetic keyboards. A Rust flasher reads the board's dev_id, obtains the matching stock image and transfers it through the documented bootloader protocol. The repository also provides profile-driven AT32F405 reference firmware, whose hardware bring-up is still experimental.
- [TJ-56-654 weather clock: replacement firmware after hardware and security analysis](https://awesomerea.org/resources/esp8266-weather-clock-case/index.md): Case study · The TJ-56-654 weather-clock project replaces the original ESP-01S firmware after an investigation of the device's hardware and configuration page. The author reports that the original page exposed the Wi-Fi password; the replacement provides NTP time, Open-Meteo weather, OLED screens, a web settings panel, and updates on the clock's 1 MB flash device.
- [Torso T-1: reconstructing the .t1 backup format](https://awesomerea.org/resources/t1-backup-file-format-case/index.md): Case study · The Torso T-1 backup-format project maps the sequencer's .t1 bank data through controlled device backups and byte comparisons. Python codecs parse and rebuild banks, export patterns to MIDI and import MIDI as device-loadable backups; the author reports byte-exact sample rebuilds and successful hardware imports.
- [open-smc-pad: replacing M-Vave SMC-PAD firmware](https://awesomerea.org/resources/open-smc-pad-case/index.md): Case study · open-smc-pad replaces the M-Vave SMC-PAD controller's firmware with a USB bootloader, runtime and Arduino core. Its stock-firmware research documents the USB-MIDI SysEx service protocol, flash layout and hardware wiring; the implementation supports pads, knobs, LEDs, USB-MIDI and BLE-MIDI.
- [Predator Sense for Linux: reconstructing PHN16-72 firmware control](https://awesomerea.org/resources/predator-sense-phn16-72-linux-case/index.md): Case study · Predator Sense for Linux reconstructs Acer PredatorSense controls for the Predator Helios Neo 16 PHN16-72. Its documentation traces Windows service behavior and firmware WMI methods, while a Linux kernel module and daemon expose performance modes, fan settings, keyboard lighting and battery controls to a CLI and Qt interface.
- [HH41V: reconstructing the GOTU/SUDH update process](https://awesomerea.org/resources/hh41v-fota-case/index.md): Case study · HH41V maps the TCL/Alcatel mobile hotspot's FOTA update process, including its AP and modem package structure and GOTU/SUDH requests. It provides Python tools to inspect archive entries, fetch packages and compare package identity with a device configuration dump, plus notes on the updater and package inventory.
- [Band 9 表盘生成器: Huawei Band 9 HWT watch-face format reconstruction](https://awesomerea.org/resources/band9-watchface-generator-case/index.md): Case study · Band 9 表盘生成器 reconstructs the Huawei Band 9 HWT watch-face package format from binary observations of public packages and builds installable packages for the 194 × 368 HWHD07 screen. Its format document records ZIP entries, payload layout, protobuf fields, data item numbers and resource slots.
- [Echo Show camera: reconstructing LineageOS camera support](https://awesomerea.org/resources/echo-show-lineageos-camera-case/index.md): Case study · The Echo Show camera project reconstructs camera support for LineageOS 18.1 on Echo Show 5 and 8 devices. Live-device findings trace missing camera providers, legacy MediaTek blobs, kernel struct differences and sensor tuning; kernel patches and userspace shims restore preview and capture. The project also documents Bluetooth and echo-cancellation fixes.
- [Yamaha SMAF Player: MA-series ringtone playback reconstruction](https://awesomerea.org/resources/yamaha-smaf-player-case/index.md): Case study · Yamaha SMAF Player reconstructs ringtone playback associated with Yamaha MA-series sound chips in C++. It parses SMAF MMF containers, decodes HandyPhone and Mobile scores and Yamaha voice data, and renders FM synthesis with optional ADPCM samples. The author based the parser and synthesizer on the public SMAF format description and examination of real files.
- [CoreFW: reimplementing Novation Launchpad firmware](https://awesomerea.org/resources/corefw-launchpad-case/index.md): Case study · CoreFW reimplements firmware for Novation Launchpad controllers with accessible bootloaders in Rust. It supplies device-specific drivers, MIDI and SysEx handling, palette editing, performance and programmer modes, and build aliases for supported RGB and earlier non-RGB models.
- [Open Arcade Coder: reconstructing LED and button control](https://awesomerea.org/resources/open-arcade-coder-case/index.md): Case study · Open Arcade Coder reconstructs control of the Tech Will Save Us Arcade Coder's 12×12 RGB matrix and buttons with an ESP32 library. The author traced board connections, identified HC595 and ICN2012 control pins, and supplies display and button examples.
- [6502 Model: reconstructing 65C02 cycle behavior](https://awesomerea.org/resources/6502-model-case/index.md): Case study · 6502 Model reconstructs the 65C02 chip’s cycle behavior in Rust from traces of external buses recorded during execution on a physical chip. Contributors add programs and signed traces as failing cases, then implement behavior to match the observed cycles.
- [D750 QEMU Verification Prototype: early Nikon D750 firmware execution in QEMU](https://awesomerea.org/resources/d750-qemu-case/index.md): Case study · D750 QEMU Verification Prototype investigates early execution of Nikon D750 firmware with a QEMU board overlay and host-side scanning and logging tools. The author reports that a selected entry function ran and returned, while the observed fragment produced no MMIO accesses or UART output. A separate toolchain changes selected 1080p bitrate-table entries in a user-supplied firmware image.
- [ILME-FX30: mapping service commands and firmware settings](https://awesomerea.org/resources/ilme-fx30-service-mode-case/index.md): Case study · ILME-FX30 Service Mode Research maps USB service-session commands and settings on FX30 firmware 6.00. It documents Senser and Jiritsu exchanges, backup structures and static analysis of appFw.so, with scripts for probing the camera. The author reports enabling a hidden continuous-shooting mode through paired settings writes and a cold start.
- [redmi-perf: reconstructing Redmi laptop performance-mode control](https://awesomerea.org/resources/redmi-perf-case/index.md): Case study · redmi-perf reconstructs performance-mode control on Xiaomi and Redmi laptops through the MIFS WMI interface to the embedded controller. Its notes map request bytes, firmware responses and mode values; a kernel module exposes the interface, while an optional NVIDIA ACPI shim fills response fields the author says the firmware omits.
- [ZTE U60 Pro Toolkit: investigating and extending router controls](https://awesomerea.org/resources/zte-u60-pro-toolkit-case/index.md): Case study · ZTE U60 Pro Toolkit investigates the MU5250 router's firmware behavior and extends its controls with an on-device Rust REST agent, web console and mobile clients. Research notes cover hidden web UI settings, SIM Toolkit communication through the RIL socket and firmware power behavior.
- [Game Boy DMG-CPU Schematics: reconstructing the DMG-CPU B chip](https://awesomerea.org/resources/dmg-schematics-case/index.md): Case study · Game Boy DMG-CPU Schematics reconstructs the Game Boy DMG-CPU B chip and SM83 core as KiCad schematics, Electric VLSI layouts and text netlists. Its overlay labels cells and wires on chip die shots, while the netlists record their connections and coordinates.
- [open-cleverpad: reconstructing the MIDIPLUS SmartPAD hardware](https://awesomerea.org/resources/open-cleverpad-case/index.md): Case study · open-cleverpad provides replacement Rust firmware for the MIDIPLUS SmartPAD MIDI controller and a reverse-engineered schematic of its mainboard. The firmware maps pads, encoders and buttons to MIDI messages and adds 64-color pad control.
- [osdbits: reconstructing the PlayStation 2 OSDSYS opening](https://awesomerea.org/resources/osdbits-case/index.md): Case study · osdbits reconstructs the PlayStation 2 OSDSYS opening animation as a standalone Emotion Engine program from a retail boot ROM image. It ports towers, fog, light streaks and refractive cubes, and compares output with GS dumps and savestates. The repository also includes VU microcode disassembly and notes on menu rendering; textures are extracted locally from the user's BIOS dump.
- [FPGABoy: Game Boy hardware implementation on FPGA](https://awesomerea.org/resources/fpgaboy-game-boy-case/index.md): Case study · FPGABoy reconstructs Nintendo Game Boy hardware in an FPGA design. The repository contains Verilog modules for the console's processor interface, PPU, memory, controls and video output, plus a design paper. The author states that the current version is nonfunctional.
- [NTRDisasm: documenting NTR 2.0 custom firmware](https://awesomerea.org/resources/ntrdisasm-case/index.md): Case study · NTRDisasm investigates the NTR 2.0 custom firmware for Nintendo N3DS. Its assembly listing and IDA script support study of code injection, hooks, in-game menus, service handles, debugger components, and privileged ARM11 calls.
- [NanoBoyAdvance: cycle-level Game Boy Advance hardware emulation](https://awesomerea.org/resources/nanoboyadvance-gba-emulation-case/index.md): Case study · NanoBoyAdvance reconstructs Game Boy Advance hardware behavior in a cycle-level emulator. It models CPU, DMA, timers, PPU and Game Pak prefetch, and provides palette, tile, background and sprite viewers. The author reports passing several GBA accuracy suites.
- [Open Steam Controller: reverse-engineered Steam Controller firmware](https://awesomerea.org/resources/open-steam-controller-firmware-case/index.md): Case study · Documents the reverse engineering of Valve's original Steam Controller, whose LPC11U37F main-processor firmware the author ran in a modified pinkySim simulator to log its hardware accesses, and uses the findings to write replacement firmware. Build options turn the controller into a USB-serial development board for querying its peripherals, or into a wired Nintendo Switch controller that presents itself as a PowerA pad. A Qt converter writes MusicXML songs as startup and shutdown jingles into an EEPROM area that the official firmware also reads, and notes record the board's pin connections and USB messages.
- [open-desk-lamp-firmware: replacement firmware for the Xiaomi desk lamp](https://awesomerea.org/resources/xiaomi-desk-lamp-open-firmware-case/index.md): Case study · Replaces the ESP8266-based Xiaomi desk lamp firmware with an open implementation of the lamp's local power, dimming and colour-temperature controls, based on the documented board wiring.
- [EchoPod: replacement firmware for the Snowsky Echo Mini 8 GB](https://awesomerea.org/resources/echopod-echo-mini-firmware-case/index.md): Case study · Replacement firmware for the Snowsky (FiiO) Echo Mini 8 GB player. The stock update image is HIFIECnn.IMG, and cmake --preset release followed by cmake --build --preset release writes build/release/HIFIEC90.IMG.
- [GLaBIOS: a scratch-built 8K ROM BIOS](https://awesomerea.org/resources/glabios-rom-bios-case/index.md): Case study · A scratch-built open ROM BIOS for vintage PC, XT, and 8088-class machines. The shipped assembly source src/GLABIOS.ASM is the build input; src/MAKE.BAT runs MASM and LINK, then GLA2ROM writes GLABIOS.ROM, which the GLA2ROM readme calls an 8KiB ROM image.
- [TC66 custom firmware: a replacement image for the RuiDeng USB-C meter](https://awesomerea.org/resources/tc66-meter-firmware-case/index.md): Case study · Replacement firmware for the RuiDeng TC66 and TC66C USB-C meters. Stock firmware is not in the repository; make release in rust/ writes tc66fw-release.enc.bin, an AES-encrypted image for the stock bootloader.
- [UV-K5: an open reimplementation of Quan Sheng firmware v2.1.27](https://awesomerea.org/resources/uv-k5-firmware-case/index.md): Case study · An archived reimplementation of the Quan Sheng UV-K5 handheld-radio firmware v2.1.27. After the submodules are fetched, make writes firmware.bin and firmware.packed.bin for the radio’s DP32G030.
- [R64Emu: low-level Nintendo 64 hardware reconstruction](https://awesomerea.org/resources/r64emu-n64-case/index.md): Case study · R64Emu reconstructs Nintendo 64 hardware behavior in a low-level Rust emulator informed by work on actual hardware. It documents the RSP's scalar and vector units, models CPU and console subsystems, and includes a debugger with disassembly, stepping, breakpoints and watchpoints.
- [Nuked-MD-FPGA: Sega Mega Drive chipset reconstruction](https://awesomerea.org/resources/nuked-md-fpga-case/index.md): Case study · Nuked-MD-FPGA reconstructs Sega Mega Drive chipset behavior in Verilog using photographs of decapped chips. Its modules cover the 68000, Z80, graphics, FM audio and supporting chips; progress notes distinguish implemented parts from variants still planned.
- [CamLink 4K: replacement gateware and firmware for an Elgato capture card](https://awesomerea.org/resources/camlink-4k-case/index.md): Case study · CamLink 4K rebuilds the first-generation Elgato Cam Link 4K capture pipeline with LiteX gateware for its ECP5 FPGA and bare-metal C firmware for its FX3 controller. It documents the HDMI receiver, DDR3 frame buffer, GPIF-II link and USB UVC/UAC output, with host tools for flashing and validation.
- [pw_firm: a Pokéwalker firmware decompilation](https://awesomerea.org/resources/pw-firm-pokewalker-decomp-case/index.md): Case study · pw_firm reconstructs Pokéwalker firmware in C for its Renesas H8 microcontroller. It covers device drivers, game logic, interface screens, and infrared communication; the author reports emulator execution and an average binary match near 76%, with the original compiler settings unresolved.
- [Strato: Nintendo Switch system emulation on Android](https://awesomerea.org/resources/strato-switch-emulation-case/index.md): Case study · Strato reconstructs Nintendo Switch system behavior in an emulator for ARMv8 Android devices. Its source includes high-level kernel and system-module implementations; the authors describe using Switchbrew and Ryujinx as references and continuing work from Skyline.
- [Nuked MD: reconstructing the Sega Mega Drive chipset](https://awesomerea.org/resources/nuked-md-case/index.md): Case study · Nuked MD reconstructs Sega Mega Drive chipset behavior in C using decapped chip photographs. Its current combination targets an NMOS 68000, NMOS Z80 and FC1004, with separate implementations for video, audio, arbitration, I/O and cartridge handling.
- [NC2000/1020Emu: Wenquxing device emulation](https://awesomerea.org/resources/nc2000-1020emu-case/index.md): Case study · NC2000/1020Emu reconstructs the hardware environment needed to run firmware dumped from Wenquxing NC2000, NC2600 and NC1020 portable computers. Its C++ code models a 6502 SoC, memory mapping, NOR and NAND flash, LCD, sound, keyboard and serial or infrared communication.
- [m-bootloader: reconstructing JieLi synthesizer boot and flash interfaces](https://awesomerea.org/resources/m-bootloader-case/index.md): Case study · m-bootloader reconstructs the boot and flash interfaces of the M-VAVE FM-1 and SMK-37 Pro/Elite synthesizers built around the JieLi AC791N chip. Its specification covers boot stages, SPI flash formats, retained-RAM handovers and the USB flash-loader command protocol. The C and pi32v2 assembly implementation provides a replacement bootloader, recovery menu and RAM flash loader for M-Flasher.
- [CEN64: register-transfer-level Nintendo 64 emulation](https://awesomerea.org/resources/cen64-nintendo-64-emulation-case/index.md): Case study · CEN64 emulates Nintendo 64 hardware and aims to model it down to register-transfer level. It runs big-endian .z64 ROMs with PIF data, supports 64DD disk images and provides a GDB connection for debugging emulated programs.
- [Orbital: reconstructing PlayStation 4 hardware for virtualization](https://awesomerea.org/resources/orbital-ps4-reconstruction-case/index.md): Case study · Orbital reconstructs PlayStation 4 hardware in a virtualization-based emulator intended to boot decrypted console kernels. Its C++ source models components including Aeolia controllers and Liverpool graphics hardware, while hardware and kernel notes record device IDs, registers and kernel interfaces.
- [TamaLIB: emulating first-generation Tamagotchi firmware](https://awesomerea.org/resources/tamalib-tamagotchi-case/index.md): Case study · TamaLIB emulates first-generation Tamagotchi devices built around Epson E0C6S46 and E0C6S48 microcontrollers, allowing their program ROMs to run on other hardware. A host implements its hardware abstraction layer for buttons, timing, audio and the 32×16 display.
- [Quansheng UV-K5 Hardware Reverse Engineering Project: V1.4 radio PCB reconstruction](https://awesomerea.org/resources/quansheng-uv-k5-hardware-case/index.md): Case study · The Quansheng UV-K5 Hardware Reverse Engineering Project reconstructs the radio's V1.4 PCB as KiCad schematic and board files. The author describes measuring removed components, photographing and sanding the board to expose inner layers, and aligning those images while tracing connections.
- [orsala_hack: reconstructing IKEA ORSALA lamp controls](https://awesomerea.org/resources/orsala-hack-case/index.md): Case study · orsala_hack reconstructs the control behavior of the IKEA ORSALA lamp in replacement STM8 firmware. It documents the original rotary-encoder actions, MCU and LED-driver connections, and changes brightness, color-temperature and power controls while saving settings to EEPROM.
- [stf-sharc: reconstructing Sega Model 2 SHARC microcode](https://awesomerea.org/resources/stf-sharc-case/index.md): Case study · stf-sharc reconstructs and annotates the two ADSP-21062 microcode images used by Sega Model 2 hardware. The assembly documents COP math commands, GEO display-list commands and FIFO exchanges; the author reports that both images reassemble byte for byte to the ROM.
- [F3DEX2: matching disassemblies of Nintendo 64 RSP microcode](https://awesomerea.org/resources/f3dex2-disasm/index.md): Case study · F3DEX2 is a set of matching disassemblies of the Nintendo 64 F3DEX2 and F3DZEX2 RSP microcode family. Matched examples include F3DEX2 2.04 through 2.08H and F3DZEX2 2.06H, 2.08I, and 2.08J, in fifo, xbus, and No Nearclipping variants.
- [B3603: reconstructing control-board behavior for replacement firmware](https://awesomerea.org/resources/b3603-case/index.md): Case study · B3603 investigates the buck converter's control board to support replacement STM8 firmware. The project maps MCU pins, display drivers and voltage and current control signals, includes board schematics, and provides firmware that the author reports is operational and serially controllable.
- [SmartClock-OSS: rebuilding SD Pro Smart Weather Clock firmware](https://awesomerea.org/resources/smartclock-oss-case/index.md): Case study · SmartClock-OSS rebuilds firmware for the SD Pro Smart Weather Clock after analysis of its stock image and flash layout. The ESP8266 firmware provides seven clock faces, Open-Meteo weather, a local settings page, and recovery through power cycling; the repository records hardware observations and installation results.
- [Radtel RT-890: reimplementing radio firmware v1.34](https://awesomerea.org/resources/radtel-rt-890-firmware-case/index.md): Case study · The Radtel RT-890 project reimplements version 1.34 of the radio's firmware as C source to study device behavior. Its tree contains application logic, radio and peripheral drivers, board support and startup code, while the author notes that some variables and functions remain unidentified.
- [Macrosilicon Custom Firmware: rebuilding USB video chip EEPROM firmware](https://awesomerea.org/resources/macrosilicon-custom-firmware-case/index.md): Case study · Macrosilicon Custom Firmware studies the 8051 mask ROM and EEPROM loading behavior of MS2107, MS2109 and MS9123 USB video chips, then builds replacement EEPROM images. Its chip notes map hooks, headers and memory addresses; host tools dump device memory and access new HID mailbox commands for status, GPIO and I2C.
- [Obliteration: reconstructing the PlayStation 4 kernel](https://awesomerea.org/resources/obliteration-case/index.md): Case study · Obliteration reconstructs the PlayStation 4 kernel in Rust for a custom virtualization stack intended to run dumped PS4 system software on Windows, Linux, and macOS. The author reports a working 64-bit kernel and VMM with GDT, TSS, IDT, syscall, and virtual-memory setup; development is focused on launching mini-syscore.elf.
- [libElysianVMU: reconstructing the Dreamcast Visual Memory Unit](https://awesomerea.org/resources/libelysianvmu-case/index.md): Case study · libElysianVMU reconstructs the Sega Dreamcast Visual Memory Unit as a C17 emulator core. It models the VMU CPU, memory, display, buzzer, and flash filesystem, supports official BIOS images, and handles VMU formats including VMI, VMS, DCI, and DCM. The repository also contains instruction-set, memory-map, and file-format documentation.
- [Digimon V-Pet: a literate disassembly of the 1997 firmware](https://awesomerea.org/resources/digimon-vpet-1997-disassembly-case/index.md): Case study · Digimon V-Pet investigates the 1997 Digital Monster firmware, focusing on Ver. 1 and comparing Ver. 2. Static analysis and emulator experiments map its Epson E0C6200 program, RAM, LCD, care and battle behavior, and device link protocol. The repository includes an article, Ghidra maps and tools that generate annotated listings from a user's firmware dump.
- [BCM5719 Firmware Reimplementation: rebuilding network-card firmware](https://awesomerea.org/resources/bcm5719-firmware-reimplementation-case/index.md): Case study · BCM5719 Firmware Reimplementation rebuilds firmware for the Broadcom BCM5719 network controller from the Ortega specification. Its source includes MIPS boot stages, an APE NC-SI handler, NVRAM and MII libraries, plus flash and register tools. The author reports testing on Talos II and Blackbird and says the firmware handles network traffic over NC-SI.
- [X-40 laser rangefinder: circuit and firmware reconstruction](https://awesomerea.org/resources/x40-laser-rangefinder-case/index.md): Case study · The X-40 laser rangefinder study reconstructs the tape measure's circuit and replaces its firmware for DIY distance measurement. The author captured I2C packets with a logic analyzer, decoded modulation-frequency values and wrote firmware that processes signals with a Goertzel algorithm; PC utilities display captured data and results.
- [CatCard: replacement firmware built around Coldcard bootloader contracts](https://awesomerea.org/resources/catcard-coldcard-firmware-case/index.md): Case study · CatCard implements Rust replacement firmware for Coldcard mk3, mk4, mk5 and Q1 hardware. It documents the protected bootloader's image layout, signature and callgate ABI, then builds board-specific wallet, storage and USB components against those fixed interfaces. The author reports that device builds run, while signing and several transports remain without end-to-end device exercise.
- [LaiNES: cycle-level NES hardware emulation](https://awesomerea.org/resources/laines-nes-emulation-case/index.md): Case study · LaiNES reconstructs NES console behavior in a cycle-level emulator. Its implementation models the 6502 CPU, PPU, audio hardware and common cartridge mappers, while technical notes describe timing the PPU at three steps per CPU cycle.
- [EP4CE6 Bitstream Reverse Engineering: mapping Cyclone IV configuration bits](https://awesomerea.org/resources/cyclone-cram-mapper-case/index.md): Case study · EP4CE6 Bitstream Reverse Engineering maps the proprietary .rbf configuration format of the Cyclone IV EP4CE6F17C8 FPGA. Its Python pipeline compiles controlled Verilog variants with Quartus, diffs bitstreams and records CRAM, LUT and routing mappings. The repository includes format findings and code for reading and writing bitstream features.
- [Powar: emulating the Pokéwalker](https://awesomerea.org/resources/powar-pokewalker-case/index.md): Case study · Powar emulates the Pokéwalker using a user-supplied ROM and EEPROM image. Its C source implements the CPU instructions used so far, EEPROM, LCD, buttons and some Timer W functions, with SDL2 builds for desktop and an Emscripten web interface. The author describes it as a prototype with major peripherals and DS connectivity unfinished.
- [GameCube IPL: investigating and reconstructing the console BootROM](https://awesomerea.org/resources/gamecube-ipl-case/index.md): Case study · GameCube IPL investigates the USA retail GameCube BootROM and develops replacement IPL code. The repository includes Bootstrap 1 disassembly, IPL call and function notes, boot-font research and source for parts of the boot process; the author reports several early milestones complete while menus and final ROM assembly remain open.
- [GoPro Metadata Format Parser: mapping GPMD telemetry](https://awesomerea.org/resources/gopro-gpmd-format-case/index.md): Case study · GoPro Metadata Format Parser maps the GPMD telemetry stream embedded in GoPro Hero 5 MP4 recordings and provides Go readers and conversion commands. The notes describe big-endian values, four-byte alignment and labels for GPS, gyroscope, accelerometer and temperature samples.
- [uLaunch: reconstructing the Nintendo Switch HOME Menu](https://awesomerea.org/resources/ulaunch-switch-home-menu-case/index.md): Case study · uLaunch reconstructs selected Nintendo Switch HOME Menu behavior in a customizable replacement. It launches and suspends applications, handles applets and controllers, and implements a subset of system settings; additional settings are being reversed and implemented.
- [uOFW: PSP kernel and firmware reconstruction](https://awesomerea.org/resources/uofw-case/index.md): Case study · uOFW reconstructs PSP kernel and hardware behavior to produce technical documentation and open source firmware. Its source tree contains kernel module implementations and headers for PSP subsystems including memory, interrupts, device control and media handling. The project describes its implementation as incomplete.
- [canon_cr3: mapping Canon CR3 camera files](https://awesomerea.org/resources/canon-cr3-format-case/index.md): Case study · canon_cr3 maps Canon camera image files, especially the CR3 container and its CRX image structures. Its format notes describe tracks, custom tags, metadata and compression, while a Python parser inspects CR3 and CR2 files and extracts selected image parts. Separate notes describe Canon HEIF images.
- [qemu-esp32-wireless: ESP32 wireless hardware emulation](https://awesomerea.org/resources/qemu-esp32-wireless-case/index.md): Case study · qemu-esp32-wireless reconstructs ESP32 Wi-Fi and Bluetooth LE hardware behavior in QEMU to run stock ESP-IDF firmware and its wireless blobs. QEMU patches model radio events, 802.11 traffic and BLE connections; the repository also provides example firmware, capture tools and test scenarios. The author reports comparing wireless timing with ESP32 hardware over JTAG.
- [rpi-open-firmware: a Raspberry Pi VPU boot firmware replacement](https://awesomerea.org/resources/rpi-open-firmware-case/index.md): Case study · rpi-open-firmware implements a replacement for the Raspberry Pi's stock VPU bootcode.bin and documents the device's boot stages. Its VC4 code initializes the clock, UART, SDRAM and ARM core; an ARM chainloader then reads the FAT boot partition and loads a Linux kernel.
- [ESP DC1: investigating and replacing Phicomm DC1 firmware](https://awesomerea.org/resources/esp-dc1-power-strip-case/index.md): Case study · ESP DC1 provides replacement firmware for the Phicomm DC1 power strip after its original app service became unavailable. The project credits original-firmware extraction, PCB photographs and U7 logic analysis; its firmware provides web setup, MQTT control, electrical measurements and overload protection.
- [fdsboot: Famicom Disk System boot ROM disassembly](https://awesomerea.org/resources/fdsboot-case/index.md): Case study · fdsboot is a 6502 disassembly of the Famicom Disk System boot ROM, split into disk I/O, PPU, joypad, timer, sound, interrupt and random-number routines with include files for the console and FDS registers. The ca65/ld65 build reassembles fdsboot.bin and compares its CRC with the original and with a second revision, 3DS and Wii VC builds, and GW and TWIN variants selected by assembler flags. It serves as a reference when disassembling Famicom Disk System titles.
- [gyx-decomp: Casio ES PLUS GYX firmware decompilation](https://awesomerea.org/resources/gyx-decomp-case/index.md): Case study · gyx-decomp is a decompilation of the Casio ES PLUS GYX scientific calculator firmware, which runs on ROHM nX-U8/100 microcontrollers. Code Casio wrote in C is recovered as ANSI C that the CCU8 compiler turns into matching assembly, Casio assembly is disassembled and reworked for RASU8, and MCU startup code is recreated from files for other U8 parts. A build script compiles, links with RLU8, converts to Intel HEX and binary, and a features file switches modes and functions to build custom ROMs. Notes cover the memory model, compiler options, segment naming and link order.
- [vmiv: View-Master Interactive Video emulator and format notes](https://awesomerea.org/resources/vmiv-case/index.md): Case study · vmiv emulates the View-Master Interactive Video system by decoding a captured tape video with FFmpeg, extracting the UART-style data bytes and auxiliary audio carried in the scanlines, and feeding them to an 8051 core that runs the VMI8802 ROM alongside a TMS9128 video chip model rendered with SDL2. Its notes document the mainboard chips, VDP register setup and VRAM map, the RLE sprite and tile records, and the packet layout with sequence numbers and CRC-CCITT checks. A companion dstool disassembles and reassembles the stack-based script bytecode delivered on the tape.

## Protocols (20)

- [open-appleremote: Siri Remote protocol reconstruction](https://awesomerea.org/resources/open-appleremote-case/index.md): Case study · Reconstructs first-generation Siri Remote Bluetooth reports for Linux, decoding buttons, touch and tvOS-style gestures. The Python implementation and protocol notes distinguish measured behavior, historical reports and inferred meanings.
- [GAMEKB-K17: reconstructing a macropad configuration protocol](https://awesomerea.org/resources/gamekb-k17-case/index.md): Case study · Implements the vendor HID configuration protocol for the GAMEKB-K17/HCY-K017 macropad. It writes key mappings, firmware macros and RGB settings, then reads them back; protocol notes separate tested commands from unconfirmed observations and other-device findings.
- [cooler-lcd: a Thermalright display protocol implementation](https://awesomerea.org/resources/cooler-lcd-case/index.md): Case study · Implements a USB picture-transfer driver for Thermalright Vision cooler displays, with a Rust dashboard replacing the vendor display application. The documented protocol sends a header and JPEG frames, with periodic resends to prevent the device reverting to its logo.
- [NJFE: a Soulear camera protocol bridge for desktop inspection](https://awesomerea.org/resources/njfe-ear-camera-bridge-case/index.md): Case study · Reuses otoscope's reverse-engineered i4season/Soulear protocol in an ESP32-C3 bridge and Python desktop viewer. The author credits Claude Code for implementation and reports streaming one Hopefox Find T to a Windows PC, with recording, orientation and LED controls.
- [ultimate2: 8BitDo controller configuration protocol and Linux client](https://awesomerea.org/resources/8bitdo-controller-hid-case/index.md): Case study · ultimate2 reconstructs the configuration protocol for supported 8BitDo controllers and implements command-line, graphical and browser clients. Its protocol document reports using REA with Ghidra on a native DLL and ILSpy on .NET assemblies to recover HID reports and configuration records. The clients read, edit and write controller settings.
- [remote-me: an Apple TV remote built from iOS Companion protocol analysis](https://awesomerea.org/resources/remote-me-apple-tv-companion-case/index.md): Case study · remote-me implements an Apple TV browser remote from analysis of iOS TVRemoteCore and Rapport frameworks. The author reports using REA and Ghidra to recover Companion transport, pairing, session, HID, touch, and keyboard behavior, then testing requests against an Apple TV. The project also controls LG webOS TVs through SSAP.
- [Attack Shark K86: recovering HID controls from the official driver](https://awesomerea.org/resources/attack-shark-k86-case/index.md): Case study · Attack Shark K86 reconstructs the yc3121 keyboard's HID controls from analysis of its official driver with REA. The notes describe 64-byte feature reports, checksums and commands; a Windows Electron client uses them to set lighting, per-key colours and the 240 × 135 display.
- [Redragon K652: macOS control from driver and HID analysis](https://awesomerea.org/resources/redragon-k652-macos-case/index.md): Case study · Redragon K652 macOS control reconstructs the keyboard's HID configuration protocol from decompilation of its Windows driver with REA and Ghidra. A SwiftUI app and k652ctl CLI use IOKit reports for wired lighting and key settings, while the protocol document ties fields to driver functions and records device observations. The tested model is the Azure K652GG-RGB-PRO.
- [AK·LINK: reconstructing AJAZZ AK820 Pro HID control](https://awesomerea.org/resources/aklink-case/index.md): Case study · AK·LINK implements Linux control of the AJAZZ AK820 Pro keyboard through its recovered wired HID commands for lighting, per-key RGB and the TFT screen. Its author documents REA-assisted investigation of a separate 2.4 GHz dongle channel, including observed usage pages, checksums and read-only probe responses; native dongle control remains in progress.
- [Etrel Load Guard Configurator: reconstructing the meter's UDP protocol](https://awesomerea.org/resources/etrel-load-guard-configurator-case/index.md): Case study · Etrel Load Guard Configurator is a Python CLI for discovering, reading and configuring Etrel Load Guard energy meters through a reconstructed UDP protocol. The author reports using REA with Ghidra on LoadGuardConfigurator.exe to recover packet fields and settings, then checking byte order and read-only measurements on a device. The tool includes dry-run writes and a simulator.
- [hw-harness: scanner USB protocol investigation](https://awesomerea.org/resources/hw-harness-reference-case/index.md): Case study · Documents an author-reported scanner investigation comparing vendor-driver USB control transfers with Linux-driver traces to infer initialization, timing and resolution parameters. The released harness organizes reference capture and comparison; it does not automatically recover a complete protocol specification.
- [Roborock Local Server: a self-hosted stand-in for Roborock’s vacuum cloud](https://awesomerea.org/resources/roborock-local-server-cloud-case/index.md): Case study · Runs a local HTTPS and MQTT stack in place of Roborock’s cloud, so supported vacuums keep live maps and controls on an isolated network without rooting or hardware changes. The maintainer’s technical write-up recounts earlier app and traffic analysis and a later investigation in which Claude Code and Codex worked against an emulated firmware environment. Compatibility is reported per model by the project and its users.
- [pypush: a Python client for Apple’s push protocol](https://awesomerea.org/resources/pypush-apns-protocol-case/index.md): Case study · Reimplements the client side of Apple’s private Apple Push Notification service (APNs) protocol in platform-independent Python: it activates as an Apple device, connects to the APNs courier, mints app-scoped tokens and receives push notifications. The project began as the author’s proof of concept for iMessage reverse engineering, but the current rewrite has removed IDS and iMessage support for now. It uses Apple’s services outside Apple’s official clients.
- [PixMob IR reverse engineering: controlling event wristbands at home](https://awesomerea.org/resources/pixmob-ir-protocol-case/index.md): Case study · Recovers enough of the infrared protocol used by PixMob event wristbands to light them at home, starting from Flipper Zero recordings made at concerts and games and replaying them to bracelets. Pulse-timing analysis found 38 kHz signals with bit intervals of roughly 700 µs, and targeted brute forcing from an ESP32 discovered hundreds of colour, fade, random and motion-mode commands, now sent through Arduino, Python and web tools. The README calls the result far from exhaustive and points to a later repository that decoded most of the full IR protocol through MCU dumping.
- [OpenDrop: an open reimplementation of Apple AirDrop](https://awesomerea.org/resources/opendrop-airdrop-reimplementation-case/index.md): Case study · Python command-line reimplementation of Apple's AirDrop protocol from SEEMOO Lab's reverse-engineering research. It finds receivers via _airdrop._tcp DNS-SD, sends binary-plist /Discover and /Ask requests over HTTPS and uploads gzip-compressed CPIO archives to exchange files with iOS and macOS. It is not affiliated with Apple.
- [bluefluff: reverse engineering Furby Connect's Bluetooth LE protocol](https://awesomerea.org/resources/bluefluff-furby-connect-ble-case/index.md): Case study · Documents the Bluetooth Low Energy interface of Hasbro's Furby Connect toy, worked out, according to its notes, from the companion app's native library, sniffed BLE traffic and trial and error. It maps the GATT services and the command and response bytes of the toy's Nordic radio and GeneralPlus controller, covering action sequences, antenna colour, mood values, sensor reports and a hidden debug screen. fluffd, a Node.js daemon built on the noble BLE library, exposes these commands through an HTTP API and a browser control page.
- [pyatv: a reverse-engineered client for Apple TV and AirPlay protocols](https://awesomerea.org/resources/pyatv-apple-tv-airplay-protocols-case/index.md): Case study · Asyncio Python library and command-line tools that act as an independent client for Apple TV and AirPlay devices by reimplementing the DMAP/DACP, Media Remote Protocol, Companion Link, AirPlay and RAOP protocols, which its protocol documentation describes as reverse engineered. That page records the recovered binary formats, Zeroconf properties, the OPACK encoding, pair-setup and pair-verify exchanges and Companion commands, with some request headers taken from Wireshark captures of the iPhone Remote app, and the bundled atvproxy relays MRP, Companion and AirPlay sessions to print decrypted messages for further analysis. On this basis pyatv provides remote control, metadata with push updates, app and account switching, audio-output management and AirPlay streaming to Apple TVs, HomePods and third-party receivers.
- [BudsPro-Headtracking: streaming Galaxy Buds Pro head tracking over Samsung’s serial protocol](https://awesomerea.org/resources/budspro-headtracking-case/index.md): Case study · Reimplements the Samsung Galaxy Buds Pro’s proprietary spatial-audio messages in a small Python script so that a PC can stream the earbuds’ head-tracking data in real time. It connects to the earbuds’ GEARMANAGER (or FACTORY) RFCOMM serial service, frames packets with start and end markers and a CRC16-CCITT checksum, enables the sensor stream with attach and two-second keep-alive messages, and decodes the rotation quaternion from the data events. A contributed script converts the quaternion to Euler angles and forwards it over local UDP to a Unity receiver; results are shown only as author-provided sample output.
- [Even G2 protocol: reverse-engineering Even Realities G2 smart-glasses BLE traffic](https://awesomerea.org/resources/even-g2-ble-protocol-case/index.md): Case study · Documents the Bluetooth Low Energy protocol between the Even app and Even Realities G2 smart glasses, worked out from captured traffic: GATT characteristic UUIDs, an 8-byte transport header with sequence, multi-packet and two-byte service-ID fields, a CRC-16/CCITT over the payload, and protobuf payloads with draft .proto definitions. A Python example built on bleak sends the seven-packet session handshake and drives the teleprompter service to show custom text. The README’s status table marks connection, handshake, teleprompter and calendar widget as working, notifications as partial, and Even AI and navigation as still under research.
- [fuji-cam-wifi-tool: reconstructing Fujifilm X-series Wi-Fi remote control](https://awesomerea.org/resources/fuji-cam-wifi-tool-protocol-case/index.md): Case study · Reimplements the Wi-Fi remote-control protocol of Fujifilm X-series cameras as a C++ library and an interactive command-line client that joins the camera's access point. Its headers name the control, event and JPEG live-view ports, message types and camera property codes, and source comments keep hex traces of exchanges along with what "the app" sends; the client connects, fires the shutter, records video, adjusts exposure settings and focus point, and streams live view, optionally into a Linux webcam device. README calls the tool very limited and mostly undocumented, so the protocol knowledge lives in code and comments rather than a specification.