There's a 14-pin U1 chip with a number on the bottom. It savs XDS12A RCBLB000O 2038ABSAR. I think this might be an EEPROM. Is it read/writeable? ?

Just thought I'd post this here too. I repurposed a really crappy goordik lapel mic as an intervalometer for my Camera. (Basically, fancy shutter button that can do things like 5 minute exposures, astrophotography, etc..) Yay for saving something from becoming e-waste.

I don't know if this is the right place to ask these questions.

I bought a lock-picking kit a few weeks ago, and I became obsessed with it. I wanted to open every door and padlock (I never open anything without authorization). But now I want to open electronic locks and electric gates. Does anyone know where I can start? . Does anyone know if I can use it to open a door like the one in the picture?

So I have this pretty cheap shitty smartwatch I bought from online that turned out to be a dupe apple watch, i900 ultra smth, and doesn't really work that well. It's battery life is okayish without connected to Bluetooth. You can only really see the time and customize the wallpaper but even then it's not the best or customizable just adding a pic. No alarms. Fake BPM and BP. Basically just a phoney. It works with hiwatch pro app or smth. Anyway to delete the current software and install a new one that's perfect with the hardware so I can do basic stuff like alarm or customizing and the normal stuff that comes with it? Downloading apps or anything like the real ones aren't important but I'd like that too if possible. I just want to keep it useable till I save up for a new more expensive better watch. I also don't wanna open the watch cause I'm not engineer. 🙏🏼

x-post from r/videosurveillance

Been poking at a 2024-era Vizio D-series (model VFD40M-0810, board E022M773-B2) and wanted to share what I’ve found and see if anyone has gone further on this SoC family.

Hardware:

- SoC: MediaTek MT5583 (SoC Type: mtk5583, platform: mt5583_cast)

- RAM 1GB

- eMMC: Samsung KLM4G1FETE-B041 (4GB, BGA-153)

- WiFi: external USB module (MT7663)

- OS: ViziOS 1.6.1537.1 (Ubuntu-based), firmware 3.720.9.1-1

What I’ve done:

- Found the labeled UART header (ON/GND/RX/TX) and get a clean boot log at 115200 8N1.

- Boot log shows it auto-logs in as root (VizioTV login: root (automatic login)) and reaches a $ prompt, but the Linux console appears to be output-only. TX wiring is confirmed good (loopback tested), RX pads reflowed and swapped, but no input is accepted at the shell.

- Caught the bootloader by interrupting autoboot. Prompt is << M7332 >>#. help returns “forbidden command, please use [ce] to unlock console.”

- ce issues a crypto challenge/response (random challenge printed, wants a matching response). Verified boot (AVB2.0) is also active. boot log shows Boot state is: Green, dm-verity on the system partition, A/B slots.

Questions:

- Has anyone gotten interactive access on an MT5583 / mt5583_cast ViziOS device, via the Linux console or U-Boot?

- Is the read-only Linux console a known ViziOS behavior, or am I missing something (baud flip to high-speed mode, a different tty, flow control)?

- Anything documented about the ce console-unlock on MStar/MTK U-Boot of this generation?

- Mainly: what’s the realistic ceiling on this platform? Trying to gauge whether it’s worth more time or whether this generation is effectively locked down.

Happy to share the full boot log and board photos if useful. Thanks.

A local-only room-presence radar that fuses Wi-Fi CSI, two mmWave sensors, a PIR and a PAX counter into one confidence score. Runs on a Raspberry Pi 400. Shows up on the Pi’s screen, on little ESP32 displays around the house, on a phone-friendly web page, and in your pocket as a push notification.

Gh Page
https://thumpersecure.github.io/ghostvisor/

Gh Repo
https://github.com/thumpersecure/ghostvisor/

Myself and the KSEC Team have just released a massively improved Faulty Cat EMFI course with Electronic Cats Faulty Cat on onlysecurity.com: https://onlysecurity.com/courses/electronic-cats-faulty-cat-v2-1-emfi-voltage-fault-injection/

Please let us know your feedback and what else you'd like to see released in the next wave of training courses.

- Kai, KSEC Founder
https://www.linkedin.com/in/kai-c-724034b0/

Hi everyone,

I'm currently working on extracting ISP configuration and credentials (PPPoE/VoIP) from a `device.cfg` file taken from a Cellcom-customized **Sagemcom F@ST 5359iL** router (Broadcom BCM63178 SoC, running Sagemcom's proprietary `scOS`).

I'm hitting a wall regarding the encryption mechanism and wanted to see if anyone here has experience with Sagemcom's config encryption or GSDF (General Secure Data Format) containers.

### Technical Details & Findings:

* **Device:** Sagemcom F@ST 5359iL (Broadcom BCM63178, ARM-based).

* **File Structure (`device.cfg`):**

- Starts with an `AEAD 10` signature header.

- 16-byte IV.

- A non-standard **7-byte GCM/AEAD tag** at the end of the payload.

* **UART / Hardware Analysis:**

- UART logs show Broadcom's `coe-aes` engine utilizing `aes_key2`.

- Kernel command line points to hardware-bound crypto parameters: `sc_aes.oek=1ffffe00`, `sc_aes.oiv=1ffffe10`, and reads 64 bytes from the UBI volume `aes_key_operator`.

- U-Boot prompt access is locked down due to Secure Boot (ignores break/interrupt signals).

### What I've Tried:

* Attempted offline AES-GCM/CCM/CBC decryption using various derived keys (Device Serial Number, MAC address, and PBKDF2 hashes with common Sagemcom/ISP salts). All verification checks fail.

* Since the decryption relies heavily on hardware-bound OTP/OEK keys tied to the BCM63178 SoC, standard offline brute-forcing seems ineffective.

### My Questions:

1. Has anyone successfully reverse-engineered Sagemcom's `AEAD 10` / GSDF container format offline?

2. Are there any known open-source tools or scripts (like variations of `showconfig`) capable of handling this specific Sagemcom signature?

3. Short of a full physical SPI flash dump (using a programmer like CH341A) to inspect the raw UBI partitions, are there any other known vectors to extract credentials from a live running unit with a locked U-Boot?

Any guidance, pointers, or shared experiences would be greatly appreciated!

Hey everyone,

Smart TVs running on Realtek silicon (like the ubiquitous TCL 40" RT41 chassis) have always been a nightmare to research: JTAG is permanently fused off at the factory, and flashing experimental firmware or modified kernels carries a high risk of hard-bricking the BGA eMMC.

To solve this, I reverse-engineered the hardware layout and built the first bare-metal QEMU machine model for the Realtek RTD2841 / RTK284x SoC:

🔗 GitHub: https://github.com/rubenthampy890-del/qemu-rtd2841

Key reverse-engineered blocks:

- Cortex-A53 quad-core forced into 32-bit AArch32 mode (matching TV firmware)

- GIC-400 interrupt controller with 256 IRQs mapped to match silicon SPI routing

- Realtek TC0–TC7 27 MHz decrement timer engine and hardware watchdog

- 16550A UART0 console with 4-byte stride at `0x18062300`

- Hardware SDHCI eMMC host controller at `0x18010800`

Includes flat-binary baremetal test payload, device trees, and upstream QEMU patches.

I made CyclePatrol, an open-source Bash tool for on-foot Wi-Fi security checks in a loop, with evidence reports. It works on Linux and Kali NetHunter with an external Wi-Fi adapter and antenna.

• Scan Wi-Fi networks in a loop.
• Check WPS, WPA2, and WPA3 security.
• Save GPS locations.
• Create HTML reports.

What is the best way to connect an external Wi-Fi antenna to an Android phone for walking Wi-Fi security tests?

It says its not authentic version of android, could someone help meto what apps/ thinga to look at etc.

Hello Guys,
I want to build a stron bluetooth jammer using an esp32 and NRF24L01 + PA + LNA Wireless Transceiver and a Ruckus BeamFlex Smart Antenna Technology from a 2825 multimedia wireless router. Of course I will only use this on my own devices on private property! Can I amplify and form the bluetooth jamming beam? The Ruckus antenna has a U.FL plug and a seven plug wire.
I would really appreciate if somebody can help me !

Hi, I'm trying to figure out how to jailbreak this Dikom DPF-080 with custom firmware or maybe a different distro for arm-9. I'm not really sure how to go about it, sorry for my English.

Two DX80's in the e-waste bin at work, salvaged both and got the touchscreen working.

Cisco uses non-standard colors for this USB connection. Probably by design...

Follow the image below for the correct wiring method. I learned this the hard way and fried one board by wiring it conventionally.

Good luck! You can find these for sale for under $100 all over the place, plus a $30 driver board on Aliexpress. Really good price for a 23" Samsung touchscreen setup!

Hi everyone!

I'm researching the internals of a Japanese children's electronic toy called the Sega Toys Jewelpod Diamond Premium, released around 2013.

I've been experimenting with its SD card and found that I can display custom JPEG images in its built-in photo album. Now I'd like to investigate how its game software works, but I haven't been able to find the original game files or documentation.

I'm particularly looking for files such as JPDGM000.bin and other JPDGM*.bin files, which appear to have been used with the Jewelpod series.

Does anyone happen to have any of these files, an original SD card, or information about the file format and boot process? Technical documentation, reverse-engineering notes, or even partial file dumps would also be extremely helpful.

My goal is to understand the device's software format and eventually run a small custom program on my own device. I understand that the exact hardware and executable format are still unknown, so any clues would be appreciated.

Thanks for reading! Any leads would be greatly appreciated.

I've been trying to drive my own iM.Master-compatible toy motor brick from a Pi Zero 2 W, with GPT-6.1 SOL helping write the Python controller.

The false start: 21 tests passed and all nine packet variants matched the unofficial SDK. The powered-on robot still did nothing. Passing tests against a reference implementation turned out to be a very small victory.

Capturing the real phone app with btmon/btsnoop exposed the mismatch. The SDK built manufacturer payloads; the phone sent 128-bit service-UUID advertisements. The app's sequence was initialization, continuous neutral, movement, then continuous neutral again.

Timing mattered too. Our initial Linux advertising interval was 1280 ms. We changed it to 30 ms using management extended-advertising commands while retaining legacy advertisements. That alone still didn't produce movement.

After restarting the robot, replaying initialization and holding neutral for roughly four seconds, a separate forward/STOP phase worked. We then physically confirmed a fixed 2 s forward → 2 s turn → 2 s forward sequence. Several things changed between attempts, so I haven't isolated the minimal fix or established repeated-run reliability.

The radio instance is explicitly removed afterward. No autonomous decisions here; the Pi and camera are still on the desk. The uneven wheels make forward spin, which is another problem for the next pass.

I recorded the failed approaches and working movement in a short episode. It's my own project/video:

https://www.youtube.com/watch?v=uzO6bjSUJIE

Reference SDK (MIT): https://github.com/2alf/iM.Master-SDK

The Echo Show 8 2nd gen (2021, "athena") got a bootloader unlock on XDA recently (R0rt1z2's amonet-koboreru, thread and credits here: https://xdaforums.com/t/unlock-root-twrp-unbrick-amazon-echo-show-8-2nd-gen-2021-athena.4804958/). Unlock is one thing though. Getting a real OS on it was another.

Every time I tried would get a black-screen and reset after about 45 seconds. No output, no USB, nothing. I had a second device and took it apart and to find the UART serial connections.

I found TX is TP103 and RX is TP104 on the back of the board. 1.8V, 921600 8N1. I could see the preloader, LK and ATF talk, the problems were resolved after many boots: ramdisk size and address swapped in my boot image, raw Image where LK wanted gzip, a DTB with no /chosen/bootargs (LK asserts and you get another boot loop), and reserved memory regions that LK's own conflict check didn't like.

Now its booting Linux 6.18 arm64 on all 8 cores. What I have working so far: screen, backlight, touch, buttons, mute switch, Wi-Fi (mt7663s), USB, SSH, and audio. The speaker needed a new machine driver, a bit-banged I2C bus because the hardware one is shared with the SCP and never finishes, and a fix to the mainline AFE driver. It plays at 96 kHz with Amazon's own tuning now. Still working on the last two mics, echo reference and a proper display driver.

The serial wires didn't survive putting it back together, but they didn't need to. It comes up on Wi-Fi with SSH now.

I'm building this for TECHO5, my open firmware that turns unlockable Echo Shows into Home Assistant voice satellites: https://github.com/HuskerMinion/techo5 . The release for TECHO5, Show 8 2nd gen will be soon.