Own The OSD Chip In Your Cheap Composite Monitor

October 3, 2026 by Jenny List 7 Comments

[Ogrinz Labs] has built a Robbie the Robot suit, which is super-cool, but has a huge flaw. When inside the suit, he’s too tall to do what the original Robbie actor did, which was to look through the “mouth” grille. He solved this with an inexpensive automotive reversing camera, but then realised its monitor had a built-in on-screen-display chip. After a lot of work, he’s published a GitHub repository that allows access to this thing for custom on-screen graphics.

The chip in question is an AMT630A, which contains video switching hardware, a graphics system for the on-screen-display, and an 8052 microcontroller core. He didn’t manage to get into the 8052’s brain, but the video below details the long path towards controlling it through an I2C port with an ESP32. The software is available as an Arduino library. His intention is to use it as a display for navigational sensor data to aid in maneuvering Robbie.

Given the status of Robbie as a sci-fi movie icon, it should come as no surprise that we’ve featured this suit before,

Continue reading “Own The OSD Chip In Your Cheap Composite Monitor” →

Teardown Of A USB-C Cable With Integrated LCD

October 2, 2026 by Maya Posch 18 Comments

The past years we have been seeing screens pop up in many new places, but seeing them in USB-C cables is still a bit of a novel thing. Out of sheer curiosity [Aaron Christophel] recently took apart one of these, to see what’s inside and what else you can do with them beyond fondling its single touch control and watch reported voltages and current.

Naturally, these devices aren’t exactly meant to be serviced by anyone, so the biggest challenge is to get into them without too much violence. Risking a blood sacrifice to the Hardware Gods, [Aaron] first attacks the display cover of this €15, 240 Watt-rated UGreen cable with sharp utensils before just taking apart the aluminium case, which ultimately gets him inside.

After this it’s clear that attacking the display cover was the right way, just requiring knowing where to apply pressure in order to invert the assembly process. Following that it’s less clear how it was assembled, though it may have involved liberal amounts of glue after sliding in the components. Rather than bothering with applying heat, instead some side-cutters quickly take care of that pesky aluminium shell.

The tiny IPS LC display is attached via a flat flex cable to the PCB with a connector, with the PCB featuring multiple voltage regulators, a MOSFET for the backlight and other parts in addition to the EN32LF056 marked MCU. After some prodding on the exposed SWD interface, it was confirmed to be a Cortex-M0+-based MCU with 64 kB of Flash and 4 kB of SRAM, which made it easy enough to use the little display to display some video frames of everyone’s favorite artist.

Since this MCU is only wired up to measure currents and voltages it cannot use the USB interface, but with some knowledge of how to non-destructively disassemble one of these connectors at least to the point of accessing the SWD pads underneath the display it could be a fun party trick to reflash the firmware with something custom.

Continue reading “Teardown Of A USB-C Cable With Integrated LCD” →

Going On A Tangent With The Intel 8087’s Hybrid CORDIC Algorithm

September 27, 2026 by Maya Posch 4 Comments

Continuing their reverse-engineering of Intel’s 8087 FPU, [Ken Shirriff] and friends took a look at one of the trigonometric functions, specifically FPTAN. The most exciting part with such reverse-engineering is probably figuring out which algorithm was used in the implementation, while trying to determine the reasoning behind the final hardware design.

If you’re running a simple MCU or MPU like the 6502 or Z80 without hardware functions you’d likely use an algorithm such as CORDIC or similar, as this requires only basic hardware features like addition, subtraction, bitshift, and look-up tables. One can also use polynomial approximation if there’s hardware support for a potential speed-up, or as is the case in the 8087, create a hybrid approach that targets speed and accuracy.

In the article the exact implementation to get to 64 bits of accuracy is detailed, starting with the 16 bits calculated using CORDIC before switching to the Padé approximant technique involving the ratio of two polynomials. Since after calculating the brunt of the final value with CORDIC the remainder is a fairly small value, this polynomial approximation is not just very accurate but also fast.

This approach allows the FPTAN and similar trigonometric functions in this FPU to hit a very high level of accuracy and not require the look-up table sizes and additional time required to work through the remaining bits with CORDIC. For those who want to see the full algorithm Intel’s engineers used, [Ken] has the full microcode listing with comments in the article as well.

As for the exact speed-up from this approach, [Ken] calculates for one value that FPTAN would spend 33% on CORDIC pseudo-division, 47% on CORDIC pseudo-multiplication and a mere 15% on the polynomial approximation along with about 5% overhead.

With the Pentium series of CPUs Intel moved completely away from CORDIC, as it’s clear that as accurate as it may be, it’s hard to scale to a significant number of bits without incurring significant time penalties. With the introduction of SIMD instructions the x87 ISA has further seen its functionality reduced, but this analysis shows once again why the 8087 made such an impact when it was released.

Reconstructing Device Firmware From SPI Reads

September 24, 2026 by Tom Nardi 13 Comments

If you wanted to extract the firmware from a mystery device, you might pull the flash chip out of it and toss it into a reader. But if you only had one chance to get it right and couldn’t risk damaging the device in the process, physically removing the chip may seem much less attractive. Reading the chip in-circuit failed — because of course it did — so what does that leave?

Well, if you follow the example of [Matthew “wrongbaud” Alt], the next tool you reach for might be a logic analyzer. In a recent write-up, [wrongbaud] explains the process of identifying, capturing, and ultimately decoding the SPI read operations used to load the firmware from a common W25Q-series flash chip at boot time. He notes it’s not a perfect solution, as in the end you’ll only be able to sniff out what the CPU actually reads, not necessarily the entire contents of the chip, but it’s a big step in the right direction if you’re reverse engineering something in the dark.

Continue reading “Reconstructing Device Firmware From SPI Reads” →

Reverse Engineering A Sony Car Stereo LCD

September 20, 2026 by Tyler August 8 Comments

For his own reasons, [Jose Luis Monteiro] (aka [emsyscode]) decided he needed to drive the LCD on a Sony CDX-A250 car stereo’s front panel using an Arduino. There’s probably a sweet project in the works, or perhaps he just wanted to see if it could be done. Either way, more power to [Jose], because he totally pulled it off and put the results up on GitHub for all to enjoy. There’s also a project video showing how he did the reverse-engineering, which you can see below.

The driver for this diminutive LCD is a chip obviously labeled LC75826W, and that’s what the Arduino ends up talking to. Thankfully, there was a datasheet available for that part, which gave [Jose] a great starting point for figuring out how to use it. While [Jose] is working with the LC75826W driver, he’s quite explicit in his GitHub repo that this repository is not a driver library for that chip. The code only targets the specific LCD on the CDX-A250 head unit. Still, if you’ve got a different oddball LCD that uses this driver, [Jose]’s code is a great place to start, and since it’s under an MIT license, you can fork to your heart’s content.

Kudos to Sony for not obfuscating the part or using a chip-on-board black blob — you can reverse-engineer an LCD driven by one of those, but it’s a lot more work. If you’re wondering how and why those black blobs come to be, we’ve got you covered.

Continue reading “Reverse Engineering A Sony Car Stereo LCD” →

Rusting An E-scooter (In A Good Way)

September 13, 2026 by Al Williams 4 Comments

It is a classic Hackaday situation. You have an Egret GT E-scooter. It has a screen that shows the usual dash stats, but that led to an annoyance. You could accidentally enter firmware update mode and, from there, enter operational mode without the security PIN. [Ben] couldn’t let that stand, so he reverse-engineered the protocol and rewrote the firmware in Rust. As he put it, “… because I have to break… everything I own…” We get it.

The mobile app was useful for some basic info, since sniffing Bluetooth is fairly easy and analyzing mobile code is, more or less, straightforward. Analysis revealed some data that doesn’t show on the display and that several things are sent back to home base tagged with the scooter’s unique ID — another reason to gut the existing firmware.

Continue reading “Rusting An E-scooter (In A Good Way)” →

Analyzing The FScale Instruction In Intel’s 8087 FPU

September 13, 2026 by Maya Posch 6 Comments

During his continuing analysis of the architecture and microcode of Intel’s highly influential 8087 floating point unit (FPU) co-processor, [Ken Shirriff] has now arrived at the point where he can put together how the 8087’s microcode implements various x87 instructions. One of these, the FSCALE instruction turned out to be far more complicated than assumed, with one might assume to be a straightforward powers-of-two scaling turning out to entail over 140 micro-instructions and three levels of sub-routine calls just to handle all cases.

The annotated die shot in the heading image shows the functional blocks that are used by this one x87 instruction, to give some kind of idea of what amount of hardware even ‘just’ scaling a floating point number involves.

Much like with the x86’s CISC-style ISA, these 8087 instructions break down into individual steps that involve everything from loading values into registers, performing operations, checking for and handling error conditions as well as stack management. As can be seen in [Ken]’s breakdown of the FSCALE implementation in the 8087 it’s all very logical, taking a high-level instruction and doing all that’s needed for a robust implementation, without bothering the developer with the details.

Of note is that the 8087’s implementations led to the IEEE 754 floating point standard, providing what definitely at the time was one of the most mathematically accurate FPUs that somehow still was financially responsible enough to make it into a relatively affordable PC.