reverse engineering

432 Articles

Reverse Engineering A Sony Car Stereo LCD

September 20, 2026 by 8 Comments

For his own reasons, [Jose Luis Monteiro] (aka [emsyscode]) decided he needed to drive the LCD on a Sony CDX-A250 car stereo’s front panel using an Arduino. There’s probably a sweet project in the works, or perhaps he just wanted to see if it could be done. Either way, more power to [Jose], because he totally pulled it off and put the results up on GitHub for all to enjoy. There’s also a project video showing how he did the reverse-engineering, which you can see below.

The driver for this diminutive LCD is a chip obviously labeled LC75826W, and that’s what the Arduino ends up talking to. Thankfully, there was a datasheet available for that part, which gave [Jose] a great starting point for figuring out how to use it. While [Jose] is working with the LC75826W driver, he’s quite explicit in his GitHub repo that this repository is not a driver library for that chip. The code only targets the specific LCD on the CDX-A250 head unit. Still, if you’ve got a different oddball LCD that uses this driver, [Jose]’s code is a great place to start, and since it’s under an MIT license, you can fork to your heart’s content.

Kudos to Sony for not obfuscating the part or using a chip-on-board black blob — you can reverse-engineer an LCD driven by one of those, but it’s a lot more work. If you’re wondering how and why those black blobs come to be, we’ve got you covered.

Continue reading “Reverse Engineering A Sony Car Stereo LCD” →

Laser Your Way Into Debug Mode On The RP2350

September 19, 2026 by 23 Comments

The RP2350 is actually a pretty secure chip, all things considered. It has secure boot, ARMv8’s TrustZone to split secure and non-secure execution, and you can permanently disable debug — the Pi Foundation even included glitch detection, meaning the traditional ‘zap the chip until it obeys’ technique is blocked. That’s why the [Ledger Donjon] security team went full Bond Villain and strapped everyone’s favourite fruit-flavoured microcontroller to a table with a slowly-approaching laser beam.

Continue reading “Laser Your Way Into Debug Mode On The RP2350” →

Writing An ESP32 Bluetooth Printer Driver In Two Acts

September 14, 2026 by 9 Comments

[Bas BotBerg] wanted to use a portable Bluetooth thermal printer to run off reports on sensor data collected by an ESP32-C3 microcontroller. But as is so often the case these days, the only official way to interface with the printer was through a proprietary smartphone application provided by the manufacturer. With no documentation on how the thing works, he set out to reverse engineer the printer’s communications protocol so he could control it from the MCU — but the route he took to get there was a bit different than what we usually see, and is an excellent case study for those who might have similar projects in mind.

The standard procedure for something like this, if it can be called that, is to use Android’s built-in debugging capability to log Bluetooth communications while running the manufacturer’s application. The resulting file can be fed into Wireshark, and with patience and some educated guesses, you can usually work out the various commands and values that get passed to the hardware.

But in this case, [Bas BotBerg] ignored the manufacturer’s software and instead used an application that can query a device and list its Bluetooth Low Energy services and characteristics. Specifically, he looks for services that are marked as writable, and starts pushing data into them to see how the printer responds. For this he uses Python with the Bleak library, as it allows him to rapidly iterate and adapt his code. After a bit of poking and experimentation, he finds the proper incantation to get the printer’s motor to kick on and advance the paper — a critical first milestone that tells him he’s on the right path.

Once [Bas BotBerg] mapped out what data needed to be sent to what endpoints to operate the printer in Python, it was a relatively straightforward process to send those same payloads using C++ code on the ESP32. For extra style points he also brought in the Adafruit GFX library so he could produce icons and more easily format the output of the printer.

It doesn’t look like [Bas BotBerg] has released the code in this case (perhaps if we all ask nicely), but we’ve seen similar efforts to bring open source drivers to these cheap Bluetooth printers for the good of the community.

Rusting An E-scooter (In A Good Way)

September 13, 2026 by 4 Comments

It is a classic Hackaday situation. You have an Egret GT E-scooter. It has a screen that shows the usual dash stats, but that led to an annoyance. You could accidentally enter firmware update mode and, from there, enter operational mode without the security PIN. [Ben] couldn’t let that stand, so he reverse-engineered the protocol and rewrote the firmware in Rust. As he put it, “… because I have to break… everything I own…” We get it.

The mobile app was useful for some basic info, since sniffing Bluetooth is fairly easy and analyzing mobile code is, more or less, straightforward. Analysis revealed some data that doesn’t show on the display and that several things are sent back to home base tagged with the scooter’s unique ID — another reason to gut the existing firmware.

Continue reading “Rusting An E-scooter (In A Good Way)” →

Bluetooth Shock Collar Keeps Wearer On Task

August 23, 2026 by 60 Comments

Like a lot of us [Liam Kloppers] had a problem with doomscrolling. Unwilling to go cold-turkey because he does find some utility in social media. He tried a number of things before deciding to say “Screw it” and just go full Pavlov on himself with some old-fashioned classical conditioning. Who needs willpower when you have electric shocks to dissuade you?

The key here was finding an electric-shock dog collar that could be controlled via a smartphone application, which meant he could reverse-engineer its Bluetooth protocol and get it linked up to his own software. The initial implementation ties his quick-and-dirty Python control program with a web server living on his laptop, which he’s configured MacroDroid to call on when his personal criterion for ‘doomscrolling’ is met.

With the shock collar wrapped around his leg, [Liam] was ready to test. It turns out dogs are a lot tougher than people, because even when set to a low level, the shock from the device made him toss his phone across the room and had him hesitant to even pick it up again.

Since he couldn’t bring himself to put the shock collar back onto his leg, he’s now thinking of an audible alarm, something we’ve seen work before. If you’re as unhappy with your habits as [Liam], perhaps consider a device like Commodore’s social-media-free phone before resorting to self-electrocution.

Hacking A Commercial Colorimeter To Add RAL Color Code Support

July 31, 2026 by 4 Comments

When you need to match paint colors, one of the tools you’ll reach for is a deck of reference colors. Another might be a colorimeter. But what if you want both? [hallko1234] created just that by reverse-engineering and then patching a CR4501 colorimeter.

It starts with a problem: every time [hallko1234] needed to check a color, he had to take a reading, write it down, run to the office, match it with a table, and then walk all the way back. That sounds like too much effort. The natural solution, of course, is to automate the process.

So he did. The CR4501 will happily give you its entire firmware over the debug port, after which it was time for analysis in Ghidra. Some hiccups, brickings and accidental erasure of calibration data later, he finally had a working version. The end result is a simple screen that, after every time you measure, displays the closest RAL color code and how close it is.

On the off chance someone else has the same colorimeter, he even made an online tool to install it for you.

Sharkfin Bites Attack Shark

July 28, 2026 by 12 Comments

The Attack Shark is a modern keyboard with fancy magnetic keyswitches, macros, configurable blinky LEDs, and more. The problem is that the configuration software only works on Windows, so [JR Lanteigne] set out to fix that. Along the way, he completely worked out the configuration protocol that this keyboard needs, and wrote the comfortable sharkfin web-app so that you can flash yours too.

Don’t have an Attack Shark? Well, you might have one of the 522 other boards that are made on the same ROYUAN hardware, but are re-branded under 100 different names. Want to find out if yours is supported? Look it up in the list here, or just plug it in and find out.

[RJ]’s path to reverse engineering the config protocol wasn’t entirely straightforward, but since the “Windows only” application was actually an Electron app under the hood, he patched it to run on Linux and logged a few configuration sessions. Of course there are gotchas like two different firmware generations and the fact that writing to flash too fast put the keyboard into a boot loop, but after these problems were surmounted, it just remained to map all of the bytes out, and wrap it all up in a user-friendly application.

We don’t have one of these fancy-schmancy keyboards, but if we did, we’d certainly be glad to have the configuration protocol documented. Nothing is worse than finding out that the company that made your keyboard has gone belly-up, and you’re left with a backlight setup that doesn’t match your new deskpad. If you’re a keyboard-head and you don’t already follow [Kristina]’s series, well you should.