Firmware · Case study:
f407 大绿板: display and button pin mappingC2
The f407 大绿板 investigation maps the pins connecting an ST7735S display module and five onboard buttons to an STM32F407VET6 development board.
- Firmware
Curated reverse engineering resources
5,191Evidence class
- C0full software reconstruction
- C1partial scope or analysis entry
- C2code & docs, no demo or download
- C3notes only
- ?Source unavailable or unreadable at review time
Firmware and hardware
260Firmware · Case study:
Dell Precision A34: mapping SMBIOS tokens to BIOS setup fieldsC2
A Dell Precision Tower 5810 and 7810 BIOS A34 investigation maps SMBIOS DA tokens to Dell setting IDs and AMI Setup bytes.
- Firmware
Firmware · Case study:
Earbud-case LED display: a probed pinout and segment mapC2
The earbud-case LED display study reconstructs the pinout and electrical drive map of an unmarked charging-case display.
- Firmware
Firmware · Case study:
TCL AC Original Module ESPHome: reconstructing WL6U air-conditioner controlC2
TCL AC Original Module ESPHome reconstructs local control of a TCL air conditioner on its original WL6U Wi-Fi module.
- Firmware
- Protocol
Firmware · Case study:
EKIY / Melis reverse engineering: emulating display firmware and decoding UI resourcesC2
EKIY / Melis reverse engineering runs the original home-screen firmware of an Allwinner F133-B display in a TypeScript application-level emulator.
- Firmware
Reviewed skyfortress/ekiy-melis-re@e56e91d
Protocol · Case study:
vfs495-driver: a Linux driver from fingerprint-reader protocol researchC2
vfs495-driver implements a Linux libfprint TOD driver for the Validity VFS495 swipe fingerprint reader.
- Protocol
- Firmware
Reviewed Ahmad-b1995/vfs495-driver@a30ad91
Firmware · Case study:
Potensic ATOM: reconstructing the DSRC02A controller cableC2
The Potensic ATOM cable investigation reconstructs the directional USB-C connection between a DSRC02A drone controller and an Android phone.
- Firmware
Reviewed TheAndiF/Potensic-ATOM-USB-C-Replacement-Cable@a90b54a
Firmware · Case study:
YBX ESP32 System Emulator: reconstructing e-ink reader hardware in QEMUC2
YBX ESP32 System Emulator reconstructs selected hardware behavior so original ESP32-S3 and ESP32-C3 e-ink reader firmware can run in QEMU.
- Firmware
Reviewed jhdvp/ybx-esp32-emulator@e52f769
Firmware · Case study:
Frontier FS2340: investigating Majority Touro radio firmwareC2
A firmware investigation of a Majority Touro radio on the Frontier Venice X/FS2340 platform maps compressed update blocks, menu and language tables, graphics, bootloaders and recovery paths.
- Firmware
Reviewed plangenh/frontier-fs2340-internet-radio-firmware@f1a8561
Firmware · Case study:
Contax N Digital: reconstructing a CCD Parameter DiscC2
The Contax N Digital CCD Parameter Disc recreator rebuilds a camera-specific calibration disc from newly captured RAW dark and white frames.
- Firmware
Firmware · Case study:
Fosi Audio MD3: mapping the DAC and replacing its controller firmwareC2
fosi-md3 investigates the Fosi Audio MD3 USB DAC and implements replacement firmware for its ESP32-S3 controller.
- Firmware
- Protocol
Reviewed BenevolentFutures/fosi-md3@c34b4bf
Protocol · Case study:
dataflash-re: reconstructing the Dataflash LWR lighting protocolC2
dataflash-re reconstructs the LWR control protocol used by Lightwave Research Dataflash xenon strobes.
- Protocol
- Firmware
Reviewed runnerr0/dataflash-re@f4f8779
Firmware · Case study:
opal-c1-revive: mapping the Opal C1 firmware and restoring camera controlsC2
opal-c1-revive investigates the Opal C1 webcam's Myriad X hardware, 32 MB NOR flash and DepthAI pipeline.
- Firmware
Protocol · Case study:
Spirit Halloween Remote: decoding Multi-Prop radio commandsC2
Spirit Halloween Remote documents radio messages recovered from a Spirit Multi-Prop remote and replays four captured commands through a Raspberry Pi nRF24L01+ transmitter.
- Protocol
- Firmware
Firmware · Case study:
Thecus N7510: reconstructing front-panel control on LinuxC2
Thecus N7510 on modern Linux restores the NAS front-panel LCD, buttons, fans and LEDs with Python daemons.
- Firmware
- Protocol
Reviewed army113/thecus-n7510-linux@23339d4
Protocol · Case study:
a2854-siri-remote-linux: reconstructing Siri Remote BLE and IR controlsC2
a2854-siri-remote-linux reconstructs Apple Siri Remote A2854 button and voice notifications for a Linux bridge that reads btmon output.
- Protocol
- Firmware
Binary · Case study:
HDF / HarmonyOS: mapping driver IPC and Linux userland compatibilityC2
The HDF / HarmonyOS investigation maps the Driver Foundation's user-to-kernel IPC path and tests selected HarmonyOS libraries on Linux.
- Binary
- Firmware
- Protocol
Firmware · Case study:
MK Typist research: mapping a keyboard and its bootloaderC2
MK Typist research maps the Mechanical Keyboards MK Typist keyboard and its stock firmware while developing a QMK port.
- Firmware
- Protocol
Reviewed jpsutton/mk-typist-research@4b2ca5f
Protocol · Case study:
Huawei MUT Unbrick Tool: reconstructing router multicast recoveryC2
Huawei MUT Unbrick Tool reimplements the multicast firmware upgrade exchange used by HuaweiMUT.exe for router recovery.
- Protocol
- Firmware
Firmware · Case study:
Tizen T-KTS firmware research: mapping the VDFS4 filesystemC2
Tizen T-KTS firmware research maps the VDFS4 filesystem inside a decrypted Samsung smart TV firmware image.
- Firmware
Protocol · Case study:
Philips Avent: reconstructing SCD923/26 local communicationC2
Philips Avent Local Protocols investigates the SCD923/26 baby monitor's QR pairing, encrypted control session, RTSP video and separate ADPCM audio channels.
- Protocol
- Firmware
Firmware · Case study:
es4308cfg: reconstructing the Edgecore ES4308-PoE config formatC2
es4308cfg reconstructs the Edgecore ES4308-PoE switch's proprietary NVRAM configuration format from differential exports.
- Firmware
Reviewed dlorent/es4308cfg@3435d03
Firmware · Case study:
microfreak-emu: rehosting Arturia MicroFreak firmware in RenodeC2
microfreak-emu rehosts Arturia MicroFreak firmware 5.0.0.2084 in Renode with models for STM32 peripherals and audio output.
- Firmware
- Protocol
Reviewed gbryant/microfreak-emu@9f80bc3
Firmware · Case study:
Ledger Nano X board map: tracing and reconstructing the main boardC2
Ledger Nano X board map reconstructs the hardware wallet's main board from photos, tracing 40 test pads, copper nets and components into a KiCad project.
- Firmware
Binary · Case study:
Pulsar II: reconstructing Linux support from Windows SCOPE analysisC1
The Pulsar II project reconstructs Linux support for the Creamware/Sonic Core DSP sound card from analysis of scScope.sys and Sim2k.dll.
- Binary
- Firmware
Reviewed faghy/SONIC_CORE_SCOPE_PCI_x64-Linux-driver@107a8bf
Firmware · Case study:
Z80 NMOS Silicon-to-RTL CPU Core: reconstructing transistor logic in VerilogC2
Z80 NMOS Silicon-to-RTL CPU Core reconstructs the Zilog NMOS Z80 processor as synchronous Verilog from a transistor-level netlist and successive logic schematics.
- Firmware
Reviewed dr-Titus/z80-silicon-rtl@53759f2
Firmware · Case study:
miband11-watchface-maker: reconstructing the Smart Band 11 .face formatC1
miband11-watchface-maker reconstructs the .face watch-face package format for Xiaomi Smart Band 11 by comparing inputs and outputs of the official compiler.
- Firmware
Firmware · Case study:
fb200-tools: reconstructing FLAMMA FB200 firmware and control protocolsC1
fb200-tools reconstructs the FLAMMA FB200 bass pedal's firmware behavior and USB HID/BLE controls in replacement firmware and device utilities.
- Firmware
- Protocol
Reviewed w1ne/fb200-tools@2e6cbb3
Firmware · Case study:
Orion Unchained: reconstructing Acer Predator Orion lighting controlC2
Orion Unchained reconstructs Acer Predator Orion desktop lighting control for Linux through a kernel driver, command-line client and desktop app.
- Firmware
- Protocol
Reviewed s0t0h/orion-unchained@8229038
Firmware · Case study:
p2afan: mapping ASPEED BMC fan control through the P2A bridgeC2
p2afan investigates the Tyan FT77C-B7079 BMC and controls its ASPEED AST2400 fan PWM registers from the host through the PCIe-to-AHB bridge.
- Firmware
Reviewed larkinwc/p2afan@2fe3417
Firmware · Case study:
Cisco CP-9951 DOOM: mapping phone input for a native game portC1
Cisco CP-9951 DOOM ports the game to run on the IP phone's ARM CPU using its local framebuffer, keypad, and media path.
- Firmware
Reviewed dennishilk/cisco9951-doom@f9c4911
Firmware · Case study:
Zeppelin Air: reconstructing USB firmware recoveryC2
Zeppelin Air Recovery reconstructs the Bowers & Wilkins speaker's USB recovery procedure from its updater library and live DFU exchanges.
- Firmware
- Protocol
Firmware · Case study:
EmuWorks: emulating NumWorks N0110 calculator hardwareC2
EmuWorks recreates the NumWorks N0110 calculator's hardware environment in Renode so ARM Cortex-M7 firmware runs on an emulated STM32F730.
- Firmware
Reviewed nat649/emuworks@cfb6e02
Firmware · Case study:
CH899: reconstructing the clock's MM32–ESP exchangeC1
CH899 firmware research reconstructs the UART exchange between the clock's MM32 movement controller and ESP8285 Wi-Fi module.
- Firmware
- Protocol
Firmware · Case study:
telink-usb-ota: reconstructing Telink USB-HID firmware updatesC2
telink-usb-ota reconstructs Telink's USB-HID OTA update exchange as a Rust Linux host tool for querying and flashing a CIDOO V65 v2 keyboard.
- Firmware
- Protocol
Reviewed jbonadiman/telink-usb-ota@df23c6e
Firmware · Case study:
K2 OpenKlipper: reconstructing the Creality K2 control stackC1
K2 OpenKlipper rebuilds the Creality K2 printer control stack around upstream Klipper and open Python modules.
- Firmware
- Protocol
Reviewed grant0013/K2-OpenKlipper@f1c4b4f
Firmware · Case study:
ThinkCentre Fan Control: recovering fan telemetry and modes from the M70t Gen 6C1
ThinkCentre Fan Control uses findings from M70t Gen 6 embedded-controller probing and ACPI table analysis to show fan RPM and offer firmware fan modes.
- Firmware
Firmware · Case study:
strix-890m-macos: investigating Radeon 890M display bring-upC2
strix-890m-macos investigates Radeon 890M display bring-up on an ASUS GA403WM running macOS.
- Firmware
Reviewed thanhnndev/strix-890m-macos@03c67c0
Firmware · Case study:
Twin Famicom: reconstructing the console power boardC2
Twin Famicom reconstructs the Sharp console's power board as a KiCad schematic and PCB design based on visual inspection and measurement of an original unit.
- Firmware
Reviewed H0smax/Twin-Famicom@56be8c4
Firmware · Case study:
EasyRazer: reconstructing Razer analog keyboard controlsC1
EasyRazer reconstructs direct controls for Razer analog keyboards in a Windows Synapse replacement.
- Firmware
- Protocol
Reviewed janeblower/easyrazer@53a3dd3
Firmware · Case study:
Sisu DCP-3: reconstructing Nokia 3210 firmware behaviorC2
Sisu DCP-3 recreates the Nokia 3210 NSE-8 v6.00 experience as new C firmware for a replacement Rev B2 mainboard.
- Firmware
Reviewed briskspirit/Sisu_DCP-3@e052404
Firmware · Case study:
vxp: reconstructing VideoNow disc playback and branchingC1
vxp reconstructs VideoNow XP player behavior by decoding picture, audio and interactive branch data from disc images.
- Firmware
Reviewed zdiemer/vxp@8e07095
Firmware · Case study:
Zamphenom: running Kemper Profiler firmware in a DSP emulatorC2
Zamphenom runs Kemper Profiler firmware in an instruction-level Motorola DSP56720 emulator and exposes its audio through a VST3 plugin.
- Firmware
Reviewed andrezaiats/zamphenom@e942abb
Firmware · Case study:
Marstek Offline Endpoint: reconstructing Venus cloud repliesC2
Marstek Offline Endpoint recreates the telemetry upload and time replies expected by Marstek Venus E and D batteries on a local server.
- Firmware
- Protocol
Firmware · Case study:
ZTE ZXSLC SR1010: analysing configuration and NAND firmwareC2
An investigation of the ZTE ZXSLC SR1010 maps its NAND partitions, encrypted rootfs, boot and upgrade paths, and config.bin format.
- Firmware
Reviewed 1234205a/zte-sr1010-research@5ace657
Protocol · Case study:
esphome-quietcool: reconstructing QuietCool fan radio controlC2
esphome-quietcool reconstructs QuietCool fan control over a proprietary 433.92 MHz 2-FSK radio link.
- Protocol
- Firmware
Firmware · Case study:
QuietCool ESPHome: reconstructing IT-AF-SMT BLE controlC2
QuietCool ESPHome replaces firmware on the IT-AF-SMT attic-fan controller and reimplements its stock BLE interface so the vendor app can still control the hub.
- Firmware
- Protocol
Firmware · Case study:
ReadyNAS RN426: reconstructing front-panel control under TrueNASC2
The ReadyNAS RN426 panel project reconstructs front-panel control from NETGEAR's stock firmware so the LCD and navigation buttons work under TrueNAS SCALE.
- Firmware
- Protocol
Reviewed riplatt/truenas-rn426-panel@2968ee0
Firmware · Case study:
Dahua IP cameras: mapping the device JSON-RPC APIC2
The Dahua IP camera and NVR investigation maps device JSON-RPC endpoints, request structure and two-step authentication from internal JavaScript.
- Firmware
- Protocol
Reviewed H3xano/dahua-rpc-api@7e521b2
Firmware · Case study:
GNR-SMU: mapping Ryzen SMU telemetry and controlsC2
GNR-SMU maps undocumented AMD Ryzen SMU power-management tables through hardware measurements, load experiments and Linux sensor comparisons.
- Firmware
Reviewed Kyworn/gnr-smu@def79d6
Binary · Case study:
SACD daemon reconstruction: rebuilding Sony BDP-BX510 sacd_extract_160C2
SACD daemon reconstruction rebuilds Sony BDP-BX510's ARM sacd_extract_160 daemon in C.
- Binary
- Firmware
- Protocol
Reviewed clintecker/sacd-reconstruct@d7ad255
Protocol · Case study:
Holy Stone H120D: reconstructing drone Wi-Fi control and video trafficC2
Holy Stone H120D research maps the drone’s Wi-Fi command, camera and video exchanges using APK decompilation, packet captures and ARM library disassembly.
- Protocol
- Binary
- Firmware
Reviewed zturner1/h120d-protocol@b323d78
Firmware · Case study:
Nokia E7-00 Linux: reconstructing the boot chain and device interfacesC2
Nokia E7-00 Linux investigates the phone's boot chain and hardware interfaces to build QEMU models and a Linux port.
- Firmware
- Protocol
Reviewed apoage/nokia-e7-linux@783eaef
Firmware · Case study:
CTS Strasbourg Ticket Reader: mapping SRI512 ticket memoryC2
CTS Strasbourg Ticket Reader maps the SRI512 memory used by Strasbourg CTS paper tickets and provides a C utility to read and decode it through libnfc.
- Firmware
Protocol · Case study:
Chronos Revived: an Android client for the recovered smart disc BLE protocolC1
Chronos Revived replaces the discontinued Android companion app for the Chronos smart disc using its recovered Bluetooth LE protocol.
- Protocol
- Firmware
Firmware · Case study:
PS2 Floating-point: reconstructing console arithmetic behaviorC2
PS2 Floating-point reconstructs aspects of PlayStation 2 floating-point behavior in Rust using console experiments as a baseline.
- Firmware
Firmware · Case study:
CD Changer Robot: rebuilding a Nistec ALW-501 controllerC2
CD Changer Robot reconstructs control of a Nistec ALW-501 disc robot after tracing its motor-driver board.
- Firmware
Reviewed busyDuckman/cd_changer_robot@755f033
Firmware · Case study:
open-ssd: reconstructing SM2263XT SSD initializationC2
open-ssd reconstructs an initialization workflow for Silicon Motion SM2263-family SSDs.
- Firmware
- Protocol
Reviewed cnfatal/open-ssd@cc06bda
Firmware · Case study:
t2-cruise: reconstructing Apple SMC power-limit behavior on LinuxC2
t2-cruise reconstructs how a T2 MacBook's Apple SMC requests CPU and GPU power limits.
- Firmware
Reviewed flo-coast/t2-cruise@9d5a7b6
Firmware · Case study:
XENO: reconstructing the Xbox 360 boot chain in a low-level emulatorC2
XENO reconstructs Xbox 360 boot behavior in a low-level emulator informed by boot-chain research and disassembly.
- Firmware
- Binary
Reviewed LuanBogoqb/xeno@6653ee0
Firmware · Case study:
rytm-fw-re: reconstructing Analog Rytm MKII firmwareC2
rytm-fw-re analyses the Elektron Analog Rytm MKII OS 1.74 update and builds a freestanding ColdFire replacement firmware wrapped as a flashable .syx file.
- Firmware
- Protocol
Reviewed ethernet8023/rytm-fw-re@2f7f0c4
Firmware · Case study:
Nokia DCT Platform Emulation: reconstructing early handset hardware behaviorC2
Nokia DCT Platform Emulation reconstructs firmware-facing hardware behavior of early Nokia phones in MAME, with the 3210 as its reference handset.
- Firmware
- Protocol
Reviewed bitplane/nokia-dct3-re@4875f4d
Firmware · Case study:
ambit-firmware: mapping Palette hardware for replacement firmwareC2
ambit-firmware develops alternative firmware for Palette devices using mapped AT90USB1286 pin connections.
- Firmware
Reviewed khimaros/ambit-firmware@8affaad
Firmware · Case study:
perfectcharge_remote: reconstructing the Waeco PerfectCharge remote PCBC2
perfectcharge_remote reconstructs the Waeco PerfectCharge marine charger remote's schematic and single-layer PCB in KiCad.
- Firmware
Reviewed speters/perfectcharge_remote@8936fed
Firmware · Case study:
Sony A7 III: firmware updater packaging and UFU container analysisC2
Sony A7 III firmware analysis maps the packaging of Update_ILCE7M3V404.exe from a Packman self-extractor through an inverted MSCF CAB to a UFU TLV container.
- Firmware
Firmware · Case study:
Capybara: reconstructing Sonix hardware for Tamagotchi Paradise firmwareC1
Capybara reconstructs the Sonix SNC73410 hardware environment needed to run Tamagotchi Paradise factory firmware on a computer.
- Firmware
Reviewed infinition/capybara@e80354e
Firmware · Case study:
ry5088-flasher: reconstructing a magnetic keyboard's HID-DFU pathC2
ry5088-flasher reconstructs the USB HID-DFU update path used by RongYuan RY5088 magnetic keyboards.
- Firmware
- Protocol
Reviewed dot-agi/ry5088-flasher@2a7db6a
Firmware · Case study:
TJ-56-654 weather clock: replacement firmware after hardware and security analysisC1
The TJ-56-654 weather-clock project replaces the original ESP-01S firmware after an investigation of the device's hardware and configuration page.
- Firmware
Firmware · Case study:
Torso T-1: reconstructing the .t1 backup formatC2
The Torso T-1 backup-format project maps the sequencer's .t1 bank data through controlled device backups and byte comparisons.
- Firmware
Firmware · Case study:
open-smc-pad: replacing M-Vave SMC-PAD firmwareC1
open-smc-pad replaces the M-Vave SMC-PAD controller's firmware with a USB bootloader, runtime and Arduino core.
- Firmware
- Protocol
Reviewed fedepaj/open-smc-pad@21cc306
Firmware · Case study:
Predator Sense for Linux: reconstructing PHN16-72 firmware controlC2
Predator Sense for Linux reconstructs Acer PredatorSense controls for the Predator Helios Neo 16 PHN16-72.
- Firmware
Reviewed aishend/predator-sense@82d8425
Firmware · Case study:
HH41V: reconstructing the GOTU/SUDH update processC2
HH41V maps the TCL/Alcatel mobile hotspot's FOTA update process, including its AP and modem package structure and GOTU/SUDH requests.
- Firmware
- Protocol
Reviewed devopnem/hh41v-fota@39f949c
Firmware · Case study:
Band 9 表盘生成器: Huawei Band 9 HWT watch-face format reconstructionC2
Band 9 表盘生成器 reconstructs the Huawei Band 9 HWT watch-face package format from binary observations of public packages and builds installable packages for the 194 × 368 HWHD07 screen.
- Firmware
Firmware · Case study:
Echo Show camera: reconstructing LineageOS camera supportC2
The Echo Show camera project reconstructs camera support for LineageOS 18.1 on Echo Show 5 and 8 devices.
- Firmware
Firmware · Case study:
Yamaha SMAF Player: MA-series ringtone playback reconstructionC2
Yamaha SMAF Player reconstructs ringtone playback associated with Yamaha MA-series sound chips in C++.
- Firmware
Firmware · Case study:
CoreFW: reimplementing Novation Launchpad firmwareC1
CoreFW reimplements firmware for Novation Launchpad controllers with accessible bootloaders in Rust.
Demo available · no screenshot - Firmware
Firmware · Case study:
Open Arcade Coder: reconstructing LED and button controlC2
Open Arcade Coder reconstructs control of the Tech Will Save Us Arcade Coder's 12×12 RGB matrix and buttons with an ESP32 library.
- Firmware
Firmware · Case study:
6502 Model: reconstructing 65C02 cycle behaviorC2
6502 Model reconstructs the 65C02 chip’s cycle behavior in Rust from traces of external buses recorded during execution on a physical chip.
- Firmware
Reviewed EmulationOnline/model_6502@bc7cf14
Firmware · Case study:
D750 QEMU Verification Prototype: early Nikon D750 firmware execution in QEMUC1
D750 QEMU Verification Prototype investigates early execution of Nikon D750 firmware with a QEMU board overlay and host-side scanning and logging tools.
- Firmware
Reviewed LuoStickmin/D750-QEMU@f41c7c8
Firmware · Case study:
ILME-FX30: mapping service commands and firmware settingsC2
ILME-FX30 Service Mode Research maps USB service-session commands and settings on FX30 firmware 6.00.
- Firmware
- Protocol
Reviewed t2r05/fx30-senser-map@0d55e27
Protocol · Case study:
redmi-perf: reconstructing Redmi laptop performance-mode controlC2
redmi-perf reconstructs performance-mode control on Xiaomi and Redmi laptops through the MIFS WMI interface to the embedded controller.
- Protocol
- Firmware
Reviewed wanxinhao/redmi-perf@98f90e4
Firmware · Case study:
ZTE U60 Pro Toolkit: investigating and extending router controlsC1
ZTE U60 Pro Toolkit investigates the MU5250 router's firmware behavior and extends its controls with an on-device Rust REST agent, web console and mobile clients.
- Firmware
Reviewed jesther-ai/open-u60-pro@5596b8d
Firmware · Case study:
Game Boy DMG-CPU Schematics: reconstructing the DMG-CPU B chipC1
Game Boy DMG-CPU Schematics reconstructs the Game Boy DMG-CPU B chip and SM83 core as KiCad schematics, Electric VLSI layouts and text netlists.
- Firmware
Reviewed msinger/dmg-schematics@28f66ae
Firmware · Case study:
open-cleverpad: reconstructing the MIDIPLUS SmartPAD hardwareC2
open-cleverpad provides replacement Rust firmware for the MIDIPLUS SmartPAD MIDI controller and a reverse-engineered schematic of its mainboard.
- Firmware
Reviewed DerFetzer/open-cleverpad@bed7a11
Firmware · Case study:
osdbits: reconstructing the PlayStation 2 OSDSYS openingC2
osdbits reconstructs the PlayStation 2 OSDSYS opening animation as a standalone Emotion Engine program from a retail boot ROM image.
- Firmware
Reviewed aap/osdbits@ea0c687
Firmware · Case study:
FPGABoy: Game Boy hardware implementation on FPGAC2
FPGABoy reconstructs Nintendo Game Boy hardware in an FPGA design.
- Firmware
Reviewed trun/fpgaboy@1f50adf
Firmware · Case study:
NTRDisasm: documenting NTR 2.0 custom firmwareC2
NTRDisasm investigates the NTR 2.0 custom firmware for Nintendo N3DS.
- Firmware
Reviewed patois/NTRDisasm@2c42c44
Firmware · Case study:
NanoBoyAdvance: cycle-level Game Boy Advance hardware emulationC2
NanoBoyAdvance reconstructs Game Boy Advance hardware behavior in a cycle-level emulator.
- Firmware
Reviewed nba-emu/NanoBoyAdvance@55b5cf0
Firmware · Case study:
Open Steam Controller: reverse-engineered Steam Controller firmwareC2
Documents the reverse engineering of Valve's original Steam Controller, whose LPC11U37F main-processor firmware the author ran in a modified pinkySim simulator to log its hardware accesses, and uses the findings to write replacement firmware.
- Firmware
- Protocol
Firmware · Case study:
open-desk-lamp-firmware: replacement firmware for the Xiaomi desk lampC1
Replaces the ESP8266-based Xiaomi desk lamp firmware with an open implementation of the lamp's local power, dimming and colour-temperature controls, based on the documented board wiring.
- Firmware
Firmware · Case study:
EchoPod: replacement firmware for the Snowsky Echo Mini 8 GBC2
Replacement firmware for the Snowsky (FiiO) Echo Mini 8 GB player.
- Firmware
Reviewed BasilSkyWalk/echopod@4013ba0
Firmware · Case study:
GLaBIOS: a scratch-built 8K ROM BIOSC1
A scratch-built open ROM BIOS for vintage PC, XT, and 8088-class machines.
- Firmware
Reviewed 640-KB/GLaBIOS@b98b0fe
Firmware · Case study:
TC66 custom firmware: a replacement image for the RuiDeng USB-C meterC2
Replacement firmware for the RuiDeng TC66 and TC66C USB-C meters.
- Firmware
Reviewed FletcherD/tc66-custom-fw@65accb4
Firmware · Case study:
UV-K5: an open reimplementation of Quan Sheng firmware v2.1.27C2
An archived reimplementation of the Quan Sheng UV-K5 handheld-radio firmware v2.1.27.
- Firmware
Reviewed DualTachyon/uv-k5-firmware@6f8afac
Firmware · Case study:
R64Emu: low-level Nintendo 64 hardware reconstructionC1
R64Emu reconstructs Nintendo 64 hardware behavior in a low-level Rust emulator informed by work on actual hardware.
- Firmware
Reviewed rasky/r64emu@5d95a7c
Firmware · Case study:
Nuked-MD-FPGA: Sega Mega Drive chipset reconstructionC2
Nuked-MD-FPGA reconstructs Sega Mega Drive chipset behavior in Verilog using photographs of decapped chips.
- Firmware
Reviewed nukeykt/Nuked-MD-FPGA@62d6e48
Firmware · Case study:
CamLink 4K: replacement gateware and firmware for an Elgato capture cardC1
CamLink 4K rebuilds the first-generation Elgato Cam Link 4K capture pipeline with LiteX gateware for its ECP5 FPGA and bare-metal C firmware for its FX3 controller.
- Firmware
Reviewed enjoy-digital/camlink_4k@55bfaba
Firmware · Case study:
pw_firm: a Pokéwalker firmware decompilationC2
pw_firm reconstructs Pokéwalker firmware in C for its Renesas H8 microcontroller.
- Firmware
Reviewed UnrealPowerz/pw_firm@0fbcd5d
Firmware · Case study:
Strato: Nintendo Switch system emulation on AndroidC2
Strato reconstructs Nintendo Switch system behavior in an emulator for ARMv8 Android devices.
- Firmware
Reviewed strato-emu/strato@ae1566a