#reverse-engineering — Public Fediverse posts

Finally got around to writing a post about my mask ROM decoding tool! https://pbx.sh/pladecode/

I'm planning to follow this up with a series of posts covering the Pentium II microcode reverse engineering project in full. Up to now all that was locked up in tweets and a few slide decks, but I feel it would be worth it to write it up. #reverseengineering #integratedcircuits #microcode #dieshots #pentiumii

I gave Qwen 3.8 27B a reverse-engineering job and it finished in 30 minutes

https://www.xda-developers.com/qwen-3-8-27b-reverse-engineering-job-frontier-model/

Comments: https://news.ycombinator.com/item?id=49407507

#HackerNews #Qwen #3.8 #27B #reverseengineering #AItechnology #productivity

Bluetooth Shock Collar Keeps Wearer On Task

https://fed.brid.gy/r/https://hackaday.com/2026/08/23/bluetooth-shock-collar-keeps-wearer-on-task/

ProgramBench Vetted: Reverse Engineering from a Runnable Binary

https://vetto.ai/companies/programbench-vetted.html

Comments: https://news.ycombinator.com/item?id=49375176

#HackerNews #ProgramBench #ReverseEngineering #BinaryAnalysis #VettedTech #CodeSecurity

This isn't USB, or is it?

it's connected through a USB port to another device and my next project is to replace this entire thing with my own PCB.

#PCB #USB #Hardware #reverseengineering

Want to learn firmware reverse engineering on an IoT device? I'll be giving a free, women-only workshop with BlackHoodie at Hexacon in Paris on October 15. #reverseengineering

https://blackhoodie.re/Hexacon2026/

Physics-model-based #RetroArch shaders for the original #GameBoy and AGS-101 LCDs

github.com/JohnnySun/re...

#retrogaming #emulation #emudev #gbdev #gbadev #gba #gameboyadvance #graphicsprogramming #reverseengineering #pixelart

From the SBCGaming community o...

Hello! Finally, I have decided what we shall have for #NakedDieFriday so here goes.

This is EM9305 by EM Microelectronic, and it's the BLE chip used in the #Lego Smart brick, another interesting chip besides their ASIC which I think I posted about before. Many thanks to the person who sent this sample in, you know who you are!

Full-res at: http://infosecdj.net/map/em-microelectronic/em9305/infosecdj_mz_nikpa60x/

#electronics #reverseengineering

Background, motivation, and thoughts around the release of Kuna, a new agent-first Decompiler designed for Autonomous Refinement - Blog Post by Zion Leonahenahe Basque #ReverseEngineering https://noelo.org/blog/kuna-release/

От одного npm‑пакета к кластеру Contagious Interview: практическое расследование supply chain‑кампании

В прошлой статье я рассказывал о случайно попавшем ко мне образце ChainVeil - вредоносном ПО из источника, который на тот момент не был зафиксирован в публичных исследованиях. На этот раз первым сигналом стал мой собственный supply chain‑мониторинг. Он сообщил о новом npm‑пакете plugin-react-vite . На первый взгляд это выглядело как очередной тайпсквоттинг - ничего особенно необычного. Но я решил пойти дальше: сначала проверить метаданные пакета, затем код, затем инфраструктуру, а уже после этого попытаться понять, кто стоит за образцом и связан ли он с чем‑то уже известным. В результате расследование ушло далеко за пределы одного package.json : от подозрительной зависимости я пришел к второму этапу размером около 30 тысяч строк, а затем - к нескольким месяцам активности, связанным пакетам, нескольким npm‑аккаунтам и уже известному кластеру. Именно этот путь я и хочу разобрать. Погрузится в расследование

https://habr.com/ru/articles/1072054/

#investigation #threat_intelligence #lazarus #apt #реверсинжиниринг #reverseengineering #расследование #аналитика #npm

VELUX CO₂ Observed series: at 160.8s, HomeKit reported 612 ppm, bytes 28–31 were 04 F1 00 80, and the derived CO₂ code was 226. At 445.8s, 626 ppm corresponded to 65 F1 00 80, also code 226. At 730.8s, 628 ppm corresponded to 00 71 80 80, code 227. At 1015.7s, 604 ppm corresponded to 04 F2 00 80, code 228. At 1300.7s, 646 ppm corresponded to 65 70 80 80, code 225.

612 ppm packet: 44 B9 9E 80 82 4C 84 BE E3 09 8A 80 08 21 89 76 80 22 9D 04 AC 04 A4 04 80 00 00 00 04 F1 00 80 2D F7 55 A5 D2 58 30 7F C9 65 C9 D1 CD F4 73 2B 7E 08 C9 60 06 D1 03 26 6E 42 0D 66 76 FB E3 2C. Decoded: 23.5°C, 68–69% RH, CO₂ code 226.

626 ppm packet: 44 B9 9E 80 82 4C 84 BE E5 09 8A 80 08 21 89 76 80 22 1D 84 A9 84 A3 84 80 00 00 00 65 F1 00 80 56 A6 EE 8D A6 91 E9 69 F9 9D A6 61 A2 00 D8 10 43 25 03 FA B5 47 24 39 9A 0A 9C 8F E6 05 C0 EF. Decoded: 23.5°C, 68–69% RH, CO₂ code 226. This has the same coarse code as 612 ppm, but byte 28 changed from 04 to 65.

628 ppm packet: 44 B9 9E 80 82 4C 84 BE E5 09 8A 80 08 21 89 76 80 22 1E 04 AA 84 A3 04 80 00 00 00 00 71 80 80 55 01 C7 D7 CB AC 1B 20 5D FD 5F 05 3B 5D A0 62 9C 05 08 05 CF 7F 51 0C 2C FB CC E6 2F DF FF F3. Decoded: 23.5°C, 68–69% RH, CO₂ code 227.

604 ppm packet: 44 B9 9E 80 82 4C 84 BE E4 89 8A 80 08 21 89 76 80 22 1C 04 AA 84 A2 84 80 00 00 00 04 F2 00 80 61 02 24 07 FF 3C 89 FC 64 42 F2 16 35 5A DE 35 96 66 3A B8 B6 06 E7 C4 CA 94 B2 38 F4 E4 72 B1. Decoded: 23.5°C, 68–69% RH, CO₂ code 228.

The code increases as CO₂ falls, confirming the inverse relationship.

646 ppm packet: 44 B9 9E 80 82 4C 84 BE E3 89 8A 80 08 22 89 76 80 22 1D 04 AA 04 A3 04 80 00 00 00 65 70 80 80 45 E3 51 6F F5 C9 AF CE CF 73 02 74 CE 7C A1 5F 09 71 AB C9 DB FF E8 9D B1 DA 27 32 DA 81 35 18. Decoded: 23.5°C, 68–69% RH, CO₂ code 225.

The current CO₂ formula is ((byte29 & 0x7F) << 1) | (byte30 >> 7). It is strongly inversely correlated with ppm, but quantized. Byte 28 changes without changing the coarse code, yet it also repeats at different ppm values, so it is not simply the missing precision. No tested 8–20-bit window yielded exact ppm, and the remaining bytes change heavily—possibly because of counters, integrity protection, whitening, or another transform.

Best theory: the gateway derives the precise HomeKit reading using filtering or measurement history while RF carries a coarse value—or the exact value lives in another protected field. Captures are available for anyone wishing to summon the protocol goblin. 🧌📻

#RTLSDR #HomeAssistant #ReverseEngineering #VELUX #HomeKit #868MHz

Follow-up from the VELUX CO₂ protocol mines: we sampled more. The goblin has evolved. 🧌📻

25 minutes of synchronized RTL-SDR + HomeKit data produced 27 clean frames:

```text

612 ppm → 04 F1 00 80
626 ppm → 65 F1 00 80
628 ppm → 00 71 80 80
604 ppm → 04 F2 00 80
646 ppm → 65 70 80 80

```

A 9-bit field tracks CO₂ strongly—but only coarsely. The other byte repeats across different readings, so it’s probably status/counter/protection, not extra precision.

Current theory: the sensor transmits a quantized value and the VELUX gateway calculates/filters the exact ppm shown in HomeKit. Or there’s another protected field still laughing at us.

Captures available. Protocol archaeologists welcome. 🏺

#RTLSDR #HomeAssistant #ReverseEngineering #VELUX #HomeKit #868MHz

Reverse Engineered Grill Controller Gets Open Firmware

https://fed.brid.gy/r/https://hackaday.com/2026/08/18/reverse-engineered-grill-controller-gets-open-firmware/

“Can Home Assistant read my VELUX CO₂ sensor?” became SDR archaeology. 😅

I tried getting HA to use the RPi connected SDR to capture RF signal from my Velux (netatmo) sensors - they report temp, humidity and CO2 ppm.

What the scan/capture revealed so far:
NXS01 @ 868.187 MHz: 2-FSK, 32.768 kbps. We can now identify sensors and decode temperature + humidity.

CO₂ changes a suspicious block of bytes but never appears plainly. Whitening, FEC, crypto—or a tiny protocol goblin? No public decoder found.

Header: `44 B9 9E 80 82 4C`

RF nerds: recognize it? Captures available!

#RTLSDR #HomeAssistant #ReverseEngineering #VELUX

Как мы научили XCUITest тапать в контролы на глубине 136 уровней вложенности

Привет! Меня зовут Даниил, я iOS-инженер в Циане. В этой статье расскажу, как мы заставили XCUITest работать с экраном, к которому он в принципе не мог подойти. У нас есть server-driven UI экран, наш BDUI, про движок которого была отдельная статья . Дерево вьюх у него настолько глубокое, что любое обращение теста к элементам падало. Причём двумя разными способами, и оба — не из-за кода, а из-за жёстких лимитов внутри самого фреймворка автоматизации. В итоге мы научились читать дерево произвольной глубины и тапать/вводить текст в поля, которые лежат глубже ~60 уровней AX-дерева, где публичный XCUITest бессилен. Далее я буду фокусироваться на общей технике для XCUITest, а не на внутреннем устройстве нашего движка. Так что статья пригодится, даже если у вас никакого BDUI нет, а просто есть очень глубокий экран.

https://habr.com/ru/companies/cian/articles/1071034/

#ios #reverseengineering #xcuitest #swift #accessibility

My latest blog post: Let's Teardown a Forty Quid Managed Switch

https://mikecoats.com/forty-quid-managed-switch/

A managed switch with 2.5G and 10G networking for less than £40 showed up in my recommendations. Time for a cheap teardown, and who knows, maybe more.

#electronics #hardware #networking #reverseEngineering

TRON, Aptos и BSC в одной цепочке заражения: расследование JavaScript-загрузчика, связанного с ChainVeil

Что произойдет, если AI-агент порекомендует пользователю заражённый репозиторий? Именно так началось это расследование: от одного срабатывания Kaspersky до многоступенчатого JavaScript-загрузчика, использующего TRON, Aptos и BSC для доставки RAT. Погрузиться в расследование

https://habr.com/ru/articles/1070914/

#threat_intelligence #reverseengineering #investigation

I had the pleasure to help my partner with her #jacquard #loom, debug something that can rip your arm off! The better web dev!
Hard to say what did it in the end:
- Wiresharked traffic between PC and loom - it's telnet, no UDP, have to listen actively!
- measured some traces, confirmed 5V signal from the hall sensor
- wiggled some connectors, like the loom's network card
- reprogrammed the motor controller to utilize+isolate the other two hall sensors

#weaving #jacqpoint #reverseengineering