THE REVERSE ENGINEERING COLLECTION
Page 21 of 21, cases 4,001–4,025. 4,025 case studies from 5,191 curated resources, with documented reconstruction methods, scope, and original evidence.
Review artifacts from REA workflows and independent reconstructions. Each entry retains its original sources and known limits.
Each case appears once under its primary subject, with all its target labels.
Cases 4,001–4,025 of 4,025
CarHack documents an investigation of CAN traffic from a 2010 Nissan Sentra. Its notes describe tapping the OBD-II port with a Kvaser interface, capturing traffic with SocketCAN and can-utils, and relating vehicle controls to observed message IDs and bits.
The HU-058D WiFi clock investigation reconstructs how its two AiP33628 drivers control a 33-LED RGB display. Logic-analyzer captures of stock behavior inform the COM and SEG map, while protocol notes describe 30-bit frames and latch timing. ESPHome and standalone ESP32 firmware drive the panel through the recovered interface.
A-OK implements the 433.92 MHz remote-control protocol used by AC114-01B controls for roller shades and projector screens. Arduino sketches capture 65-bit commands and transmit pairing, movement and stop commands; the README identifies tested motors and RF receivers.
Q-Hub Relay Control implements a browser-operated client for the OTAQ Q-Hub relay board using a protocol recovered from the vendor's Windows utility. Its documentation specifies TCP command frames, a Fletcher-style checksum, UDP discovery and status replies, including observed inaccuracies in device status fields.
The Markisol investigation captures 433.92 MHz commands from motorized-shade remotes and reuses their 41-bit messages from Arduino or Raspberry Pi control code. It documents remote IDs, capture steps and example pairing, up, down and stop commands for compatible shades.
Huawei R48xx documents the CAN communication of Huawei 48 V power supplies, including 29-bit identifier fields, status commands, registers and software address negotiation between units. The author combines tests on R4830S1, R4850G2 and R4850G6 with other documentation. The repository also records connector pinouts and printable enclosure models.
OpenChirp reconstructs the Chirp data-over-audio protocol in an Android transmitter and receiver example. Its notes describe the frequency alphabet, payload and header frames, and Reed–Solomon error symbols, with an Octave walkthrough of the encoding.
Photo! extends Game Boy Camera behavior in a replacement ROM using sensor rules assessed from MAC-GBD communication logs. It exposes manual sensor controls, changes printing speed, and defines a fast image transfer exchange using the standard printer INIT packet followed by a 0x10 packet carrying 3,584 image bytes. The source includes Game Boy and Game Boy Color builds.
Xbox Live Machine Account Creation Service investigates Xbox Live 1.0 authentication exchanges through a C# replacement service. The author reports parsing AS-REQ messages, decrypting encrypted timestamps and constructing AS-REP responses, while the service remains incomplete.
The Quansheng UV-K5 investigation examines the radio's programming exchanges and memory contents to support open-source radio software. It includes captured read and write traffic, a deobfuscation script, a recovered memory-map spreadsheet, and an experimental CHIRP driver.
TSP143IIIU Wi-Fi Print Bridge reconstructs StarIO exchanges so a Raspberry Pi can present a USB-only receipt printer to Shopify POS as a Star LAN printer. Its protocol research documents UDP discovery packets, USB and LAN ASB frame differences, ETB counters, and TCP/9101 status polling from hardware captures.
AirVideo for Ruby implements a client for the AirVideo server from a reverse engineered communication protocol. It browses folders and videos and obtains playable or live transcoded video URLs, with options for output dimensions.
OpenRad reimplements Radmin VPN as a Rust desktop and command-line client with a virtual Ethernet interface. Its documented wire format and transport engine cover network membership, peer authentication, direct TCP and UDP connections, and relay fallback; Android, Python and Minecraft clients share the format.
FANUC RMI Mock reconstructs the server side of the Remote Motion Interface from fanuc_ucl's published client models. Its Python TCP server handles the connection handshake and motion-command stream, forwarding joint setpoints to a simulated Moveo arm or optional robot bridges.
openfsd implements a multiplayer flight-simulation server for the reverse-engineered VATSIM FSD protocol. Its Go server connects pilots and controllers, while a detailed protocol reference maps message identifiers and its web interface manages users, settings and connections.
Google Wifi API documents HTTP endpoints discovered on Google Wifi Router and OnHub. It records status, connected-device, configuration and setup routes, including required Host headers, POST payloads and a captured JSON response.
UniFi Protect API is a TypeScript client that decodes the controller's undocumented updates WebSocket protocol. Its documentation records the four-frame packet layout, eight-byte headers and payload formats, while the library turns the stream into typed camera and doorbell events.
Chiaki implements a PlayStation 4 and 5 Remote Play client for desktop, mobile, and Nintendo Switch platforms. The project credits analysis of the registration and wakeup protocols and documents console discovery, account identification, PIN registration, and source builds.
esp8266-midea-dehumidifier replaces a Midea-made dehumidifier's Wi-Fi dongle with an ESP8266 adapter that speaks to the unit over TTL serial and exposes controls through MQTT. The author says its control logic draws on Android app reverse engineering and UART traffic analysis.
castv2 documents and implements the Chromecast CASTV2 protocol over TLS. Its Node.js client exchanges length-prefixed Protocol Buffers messages with a dongle, and its protocol notes describe namespaces, virtual connections, heartbeat messages and device authentication.
wycliffe is a clean-room implementation of the Dante protocol for uncompressed, multichannel, low-latency digital audio over Ethernet. Its notes record observed Dante packets, including channel labels and a session handshake.
ps4-waker implements the PlayStation App's local PS4 discovery and control exchanges in a command-line tool and JavaScript API. It responds to app broadcasts and simulates registration to obtain credentials, then authenticates over the app's TCP protocol to wake the console or send control commands.
NJUConnect implements a Go client for Nanjing University's EasyConnect VPN service using a custom TLS ClientHello and separate tunnel receive and transmit handshakes. Its code handles web login, token exchange, IP assignment and a SOCKS5 endpoint backed by gVisor networking.
LGTV reconstructs control of a 2014 LG webOS TV in a Node.js client. The author documents SSDP discovery, WebSocket pairing on ports 3000 and 3001, and cleartext JSON requests observed with network tools, then uses them for input, volume and app controls.
Inferno implements Dante audio networking on Linux from reverse-engineered protocol behavior. Its Rust components send and receive audio with Dante devices, while an ALSA virtual soundcard and a raw-audio pipe adapter expose streams to local applications.