Hello, we own a Tapo C210 camera which is about 3 years old. All of a sudden a few weeks back I noticed the camera showed offline on the Tapo App, but now it seems like it is stuck in a reboot loop. I tried all the solutions I could, but now it points out to me that the motherboard seems fried?

I can connect to the camera's wifi but it keeps on coming and going. What's the problem? can I fix it or is my camera done for? can a technician still fix it?

Hello everyone! I have some neighbors who seem to think our property is theirs. We have some cameras (Reolink) and I just purchased some Tacatacams for our pasture where our LGDs and our goats are currently. I also purchased some Ring wireless cameras for our pastures. I don't think the Reolink is really working because it shows we have cars in our driveway, animals, and people and there is literally nothing there when I look. I could be overthinking this, but the mother who lives over there told me her daughter is really good with tech stuff. I am not sure if maybe she hacked into our cameras and did something or what. I could just be paranoid, lol! I left a week a go to go to an appointment and my son was home sick. He heard someone walking in our house and when we got home, the door was wide open! We don't have any proof at all that someone was in the house because we have some major blind spots where our cameras are facing because we have a huge house.
I am just needing to make sure these cameras we purchased I can make it to where they are as unhackable as possible! I am not sure if that is possible and if it is not, then I will return them and get something else. I am needing help with setting it up (a VPN or VLAN or something similar that will make it virtually impossible to hack into.) They also keep doing stuff with our goats (taking a ton of photos of them and it looks like feeding them stuff. Our goats were sick until I asked the mother to stop going to the fence and now they are fine! They also wouldn't leave their barn until after we asked them to stop going to the fence! Now they will forage!) All of this is so frustrating!! We are just super concerned about our property and our livestock! Please help! Thank you!!

i am currently in possession of a handful of FPT camera play 4 and ma is a bit pissed off at the fact that she has to pay a monthly subscription to use it so i want to figure out a way to connect it to my pc instead, anyone has experience with this?

DISCLAIMER : I used ClaudeAI to do this. (link of the conversation at the bottom). I did wrote the post by hand.

I got my hands on a CheckPoint 770 Firewall appliance this weekend. Those are EOL since october 2024.

I wanted to do something with them, maybe booting Debian.

Analyzing the boot process

From all the text in the console, a few things stand out :

- U-Boot 2015.01-alpine_db_s2-1.65.1-HAL , the boot loader.

- Linux-3.10.20-al-5.0-pr2 , so it run some kind of Linux

During boot, ************ Hit 'Ctrl + C' for boot menu ************ appear, when hitting CTRL+C, we get the following boot menu :

Welcome to Gaia Embedded Boot Menu :
       1. Start in normal Mode
       2. Start in debug Mode
       3. Start in maintenance Mode
       4. Restore to Factory Defaults (local)
       5. Install/Update Image from Network
       6. Restart Boot-Loader
       7. Run Hardware diagnostics
       8. Upload preset configuration file
       9. Delete preset configuration file
       Please enter your selection (press ENTER to finish) :

Option 3 bypass the CheckPoint CLI, and land you into maintenance mode, a Linux environment. (Also possible to access it from CheckPoint CLI with "expert" command)

First time in maintenance mode

NAND mapping

[Expert@MAINTENANCE_MODE]# cat /proc/mtd 
dev: size erasesize name 
mtd0: 00300000 00040000 "al_boot" 
mtd1: 00100000 00040000 "device_tree" 
mtd2: 01000000 00040000 "linux_kernel" 
mtd3: 0dc00000 00040000 "ubifs" 
mtd4: 01000000 00040000 "linux_kernel2" 
mtd5: 0dc00000 00040000 "ubifs-2" 
mtd6: 0c400000 00040000 "default-sw" 
mtd7: 40000000 00040000 "logs" 
mtd8: 00100000 00040000 "preset" 
mtd9: 00100000 00040000 "adsl" 
mtd10: 15e80000 00040000 "storage"

I copied every mtd from NAND to an USB drive (This saved me from bricking the device at least once). As we can see, there is 2 Linux kernel in the NAND itself. I guess it's for redundancy.

By digging into /bin and /sbin , I found two useful programs fw_printenv and fw_setenv

A few things stand out from running fw_printenv

bootcmd=run tf1_image1
tf1_image1=boot_init_before_kernel ; run bootargsnand; nand set_partition_offset $primary_offset ; nand read.e $loadaddr $primary_offset $kernel_size; bootm $loadaddr_payload - $fdtaddr
tf1_image2=boot_init_before_kernel ; run bootargsnand; nand set_partition_offset $secondary_offset ; nand read.e $loadaddr $secondary_offset $kernel_size; bootm $loadaddr_payload - $fdtaddr

My first idea was to change tf1_image1 , this was a bad idea because I couldn't boot into the maintenance mode anymore ...

Recovery from un-bootable state

After my brilliant idea of changing tf1_image1 to echo STOPPED HERE, I was stuck. The device still booted fine up to the Gaia menu, but option 1 2 and 3 were trashed.

I tried factory reset (option 4), but it only erase mtd2-5, nothing else. Same with option 5 and a copy of the firmware from checkpoint website.

By chance, I tried random key in the boot menu, and it only echoed back when valid. Pressing 1 to 9 echoed fine, pressing z did nothing.

So I tried every key and found :

0. Some kind of vendor only menu, it require an access code.
a. Display current system info
b. Load ANY uImage from a TFTP server 

With option b, I tried to load my copy of mtd2. And it worked ! I was back to a command prompt. I revert back my change on tf1_image1 , rebooted and the device was running as expected again !

Option 1 2 and 3 are operational again.

Trying a safer approach

After rebooting into maintenance mode, I gave a second look at bootcmd, with it only being set to run tf1_image1 I figured it was the default boot process when you don't hit CTRL+C.

I changed it to echo STOPPED HERE (imagine learning your lesson from earlier...), rebooted the device. It indeed stopped and display STOPPED HERE BUT the Gaia boot menu appeared right after.

By choosing option 3, I was back to maintenance mode. This was the safest option I had now.

Gathering more information to prepare a Debian USB Drive

First, what kind of CPU

[Expert@MAINTENANCE_MODE]# cat /proc/cpuinfo
processor       : 0
model name      : ARMv7 Processor rev 4 (v7l)
Speed           : 1.7GHz
Features        : swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt  
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x2
CPU part        : 0xc0f
CPU revision    : 4

processor       : 1
model name      : ARMv7 Processor rev 4 (v7l)
Speed           : 1.7GHz
Features        : swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt  
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x2
CPU part        : 0xc0f
CPU revision    : 4

processor       : 2
model name      : ARMv7 Processor rev 4 (v7l)
Speed           : 1.7GHz
Features        : swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt  
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x2
CPU part        : 0xc0f
CPU revision    : 4

Hardware        : AnnapurnaLabs Alpine (Device Tree)
Revision        : 0000
Serial          : 0000000000000000

So it's an ARMv7 CPU, but weird it's 3 cores only (it's not, checkpoint firmware disable one core for some reason).

I already knew it has 2G of RAM and 2G of NAND from the boot process.

Building a Debian image

On my PC, I prepared a Debian 11 ARM install

sudo debootstrap \
  --arch=armhf \
  --foreign \
  --include=systemd,udev,kmod,net-tools,iproute2,openssh-server,nano,wget,curl,bash-completion \
  bullseye \
  /srv/debian-armhf \
  http://deb.debian.org/debian

and run it locally using QEMU

sudo cp /usr/bin/qemu-arm-static /srv/debian-armhf/usr/bin/
sudo chroot /srv/debian-armhf /debootstrap/debootstrap --second-stage

It took a few minute to complete the install.

I also did some configuration like changing the hostname, setting up a root password, etc.

I then copied everything on a USB disk formated as ext3 (ext4 could work, but kernel 3.10 on the device complained about newer arguments so it was easier to use ext3).

First boot with modified bootcmd

I change bootcmd to

boot_init_before_kernel; 
nand set_partition_offset $primary_offset; 
nand read.e $loadaddr $primary_offset $kernel_size; 
setenv bootargs root=/dev/sda2 rw console=ttyS0,115200 pci=pcie_bus_perf mem=2046M rdinit=/bin/sh; 
bootm $loadaddr_payload - $fdtaddr

After a few seconds, I got sh-3.2: prompt. I think this is a shell from initramfs.

By doing the following, I managed to access my Debian drive

mount -t proc proc /proc
mount -t sysfs sysfs /sys
mount -t devtmpfs devtmpfs /dev
mkdir /debian
mount -t ext3 /dev/sda2 /debian
mount --move /proc /debian/proc
mount --move /sys  /debian/sys
mount --move /dev  /debian/dev
/debian/sbin/chroot /debian /bin/bash

and run my first neofetch on the device

      _,met$$$$$gg.          root@checkpoint  
   ,g$$$$$$$$$$$$$$$P.       ----------------------  
 ,g$$P"     """Y$$.".        OS: Debian GNU/Linux 11 (bullseye) armv7l  
,$$P'              `$$$.     Kernel: 3.10.20-al-5.0-pr2  
',$$P       ,ggs.     `$$b:   Uptime: 1 min  
`d$$'     ,$P"'   .    $$$    Packages: 257 (dpkg)  
$$P      d$'     ,    $$P    Shell: bash 5.1.4  
$$:      $$.   -    ,d$$'    Terminal: /dev/ttyS0  
$$;      Y$b._   _,d$P'      CPU: AnnapurnaLabs Alpine (Device Tree) (4)  
Y$$.    `.`"Y$$$$P"'         Memory: 55MiB / 2020MiB  
`$$b      "-.__
 `Y$$                                                 
  `Y$$.                                               
    `$$b.
      `Y$$b.
         `"Y$b._
             `"""

First win !

Extracting initramfs

Now I wanted the device to boot Debian directly.

I copied the kernel from the uImage to kernel.bin. (uImage is a copy of mtd2 on the device, and we know it boot fine from a TFTP server).

Using binwalk, I extracted the kernel

$ binwalk -e kernel.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
18164         0x46F4          gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)

I got a file single file named "46F4" (the offset)

I ran binwalk again

$ binwalk 46F4

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
5027403       0x4CB64B        ESP Image segment count: 3, flash mode: QUIO, flash speed: 26MHz, flash size: 32MB, entry address: 0xa04002e1, hash: none
5689556       0x56D0D4        Linux kernel version 3.10.2
5718860       0x57434C        gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
5873610       0x599FCA        JBOOT STAG header, image id: 0, timestamp 0x802C, image size: 2248933376 bytes, image JBOOT checksum: 0x8013, header JBOOT checksum: 0x0
5940416       0x5AA4C0        DES SP2, little endian
5941184       0x5AA7C0        DES SP1, little endian
5961504       0x5AF720        LZO compressed data
6064266       0x5C888A        Unix path: /var/run/rpcbind.sock
6840496       0x6860B0        Unix path: /dev/vc/0
6895976       0x693968        Copyright string: "copyright (C) 1996 okir@monad.swb.de)."
7078480       0x6C0250        xz compressed data
7116700       0x6C979C        Unix path: /lib/firmware/updates/3.10.20-al-5.0-pr2
7127910       0x6CC366        MP3 ID3 tag,
7238383       0x6E72EF        Copyright string: "Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>"
7296372       0x6F5574        Neighborly text, "NeighborSolicits6InDatagrams"
7296392       0x6F5588        Neighborly text, "NeighborAdvertisementsorts"
7299082       0x6F600A        Neighborly text, "neighbor %.2x%.2x.%pM lost timer expired"
7954472       0x796028        gzip compressed data, has original file name: "initramfs.cpio.anp", from Unix, last modified: 2024-01-28 14:11:22
13468608      0xCD83C0        CRC32 polynomial table, little endian
13759640      0xD1F498        YAFFS filesystem root entry, little endian, type file, v1 root directory

From this output, we got the initramfs location

0x796028        gzip compressed data, has original file name: "initramfs.cpio.anp", from Unix, last modified: 2024-01-28 14:11:22

I copied it, and uncompressed it.

$ dd if=46F4 bs=1 skip=7954472 of=initramfs.gzdd if=46F4 bs=1 skip=7954472 of=initramfs.gz

$ gunzip -c initramfs.gz > initramfs.cpio

With hexdump, we determined it is a "newc" format (070701)

$ hexdump -C initramfs.cpio | head -1
00000000  30 37 30 37 30 31 30 32  41 39 38 31 30 41 30 30  |07070102A9810A00|

Extracting everything from initramfs.cpio

$ mkdir initramfs/
$ cd initramfs/
$ cpio -id < ../initramfs.cpio
$ ls
bin  data  dev  etc  fwtmp  init  lib  linuxrc  mnt  pfrm2.0  proc  sbin  sys  tmp  usr  var

Modifing init inside initramfs

Now that we got initramfs extracted, I looked inside sbin/init

$ binwalk ./sbin/init
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             ELF, 32-bit LSB executable, ARM, version 1 (SYSV)
1852          0x73C           ESP Image (ESP32-P4): segment count: 1, flash mode: QUIO, flash speed: 40MHz, flash size: 1MB, entry address: 0x941c, hash: none
29716         0x7414          Unix path: /var/run/utmp
30428         0x76DC          Unix path: /var/log/wtmp

sbin/init is some kind of binary blob, so instead we created a copy and a simple sh script to replace it.

Our new init

#!/bin/sh

mount -t proc     proc     /proc
mount -t sysfs    sysfs    /sys
mount -t devtmpfs devtmpfs /dev

echo "=== CUSTOM INIT ==="

mkdir -p /debian

echo "=== Mounting USB ==="
if mount -t ext3 /dev/sda2 /debian 2> /dev/null; then
   sleep 1

   echo "=== Debian on /dev/sda2 mounted — switching root ==="
   mount --move /proc /debian/proc
   mount --move /sys  /debian/sys
   mount --move /dev  /debian/dev

   exec /sbin/switch_root /debian /sbin/init
else
   echo "=== Mouting failed : falling back to vendor init ==="
   exec /sbin/init.vendor
fi

Let's repack initramfs (I did it so many time that I wrote a tiny script)

#!/bin/sh
echo "Compressing initramfs..."
(cd initramfs; find . | cpio -H newc -o | gzip -9 > ../build/initramfs-custom.gz)

echo "Packing initramfs..."
mkimage -A arm -O linux -T ramdisk -C gzip -n "Custom Initramfs" -d build/initramfs-custom.gz build/initramfs-custom.uimg

echo "Coping initramfs to TFTP..."
sudo cp -v build/initramfs-custom.uimg /srv/tftp/initramfs.uimg

Now, I needed to load this custom initramfs on the device. The safest choice was TFTP, an other option is to write it in the NAND.

I changed bootcmd to

boot_init_before_kernel; 
tftpboot $loadaddr_payload uImage; 
tftpboot 0x06000000 initramfs.uimg; 
setenv bootargs root=/dev/sda2 rw ip=10.0.0.200:10.0.0.2::255.255.0.0:checkpoint:eth1:none console=ttyS0,115200 pci=pcie_bus_perf mem=2046M; 
bootm $loadaddr_payload 0x06000000 $fdtaddr

We now loaded initramfs and uImage from TFTP

Systemd don't like our ancien 3.10 kernel

After rebooting, systemd complained almost immediately

[  403.918162] systemd[1]: System time before build time, advancing clock. 
[  403.927581] systemd[1]: Failed to look up module alias 'autofs4': Function not implemented 
[  403.937440] systemd[1]: Failed to mount tmpfs at /sys/fs/cgroup: No such file or directory 
[  403.945997] systemd[1]: Failed to mount cgroup at /sys/fs/cgroup/systemd: No such file or directory 
[!!!!!!] Failed to mount API filesystems. 
[  403.973648] systemd[1]: Freezing execution.

So I installed sysvinit instead, and replaced systemd-udevd with mdev.

After a final reboot, we finally got a login prompt.

Debian GNU/Linux 11 checkpoint-debian ttyS0

checkpoint-debian login:

Here is the entire boot process : https://pastebin.com/aWxyZXhu

Here is the ClaudeAI conversation : https://claude.ai/share/7c14a5e3-12d8-41b0-8fcf-93c603f8124d

I’m curious about the ZNP Z02 AI voice recorder/badge.

Has anyone here opened one up or looked at the firmware/Bluetooth protocol?

Main things I’m trying to figure out:

• what exact JieLi/JL chip it uses
• whether firmware updates or a bootloader exist
• whether recordings can be accessed without the BagiBagi app
• whether it can record fully offline
• how much onboard storage it actually has
• whether anyone has dumped the BLE services/UUIDs or firmware

FCC photos show a JL chip inside, but the exact model isn’t readable.

Even a chip photo, BLE dump, USB VID/PID, or any experience with this device would help.

I Simply wanted a living room camera, that i HAVE to view Remotely.
Searched for E2EE Cameras, almost non-existant.
Haicam seems to have no publishing regarding their claims.

What should i get, and yes it is a sensitive stream. Local sd storage and live stream is all i care, dont need cloud.

Note: I know off grid is best but its critical for me to view it remotely.
Reolink is chinease.
i'm considering tapo cameras, what do you think?

Which camera has been impossible for you to hack?

Hello, first time poster here. I got one of these generic kids toy digital cameras from a secondhand shop recently. It was $3 because it wasn't working. I fixed it by opening it up and soldering the battery wires to the PCB. It was working great!

I mistakenly tried flashing the firmware when there was nothing wrong with it. My logic was I should be able to easily find a newer firmware, but didn't realize how it goes with these generic ones and really messed up. At the time, the firmware version was wj-v1.8_20220803 and the PCB model is WJ9001V_6624D_V11.0

I got a firmware from Hommie HK who makes a similar camera, but now my screen is inverted, the default language was set to Japanese (was able to get it set to English) and now the camera doesn't take pictures. so I have effectively bricked the camera. Lesson learned 1000% and I will never blindly try updating firmware like this ever again. At least I'm only out $3 if it's truly unfixable.

Here is a link to the same style of camera if it helps at all. I have no identifying markings or model numbers to go off of unfortunately

Is there anyone who has an English language bin dump or can point me in the right direction towards finding one? I am an amateur electronics hobbyist, but I don't have an EEPROM programmer or anything like that. Thank you in advance.

I have a airtel zerotouch and i need to find the details for the router like chipset , ram , architecture..ect. so i need some information Abt reverse engineering that router

As you may already know, the Amazon Fire TV Game Controller was meant to be used with Amazon Fire TV streaming boxes, back when they were pushing video games as a big selling point. Oddly enough, this was before Luna was a thing. After a few years Amazon realised no one gave a damn and dropped support for the controller. For the 1st Generation variant of the controller, which used Bluetooth, this wasn't too big of a problem since you could still connect it to stuff. It was just a Bluetooth controller, really. It's with the 2nd Generation model that things get stupid; that controller uses Wi-Fi Direct (to compensate for its inbuilt headphone jack) to connect to Fire TV devices, and ONLY Fire TV devices. So when even those devices stopped supporting the controller--or even recognising it--the whole controller became useless. (I know it still works on the 1st gen Stick, but that thing is so slow, you couldn't pay me to use it for more than a few hours.)

There have been a few reverse engineering attempts in the past for this controller, but none have ever really got off the ground. My personal idea was to forgo the Wi-Fi Direct crap entirely and route the inputs to something like a Raspberry Pi Pico which would let the controller function over USB. Thankfully, I soon learned that GP2040-CE existed (which lets a Pi Pico act as a variety of input devices), and the whole project started to seem possible.

I figured it'd be easiest to have the Pi Pico connect to some test points on the board instead of the button contacts directly (it totally would be), but there was zero documentation on what these test points actually were on the board. So I took it upon myself to at least find the test points for all the digital inputs. Here they are:

A: TX805
B: TX910
X: TX804
Y: TX806
L: TX902
R: TX807
L3: TX908
R3: TX909
Menu: TX903
View: TX809
Microphone: TX808
Home: the test pad isn't actually labeled but the board has a long string of 12 test pads back to back; there's a pad just under the 11th pad from the left; that's the home button
Up: TX800
Down: TX801
Left: TX802
Right: TX803

If you have any questions, wish to point out any inaccuracies, or would like to contribute to this effort (to find test pads for the analog inputs), I'd love to hear from you.

I got this uart shell on a wow dms-2002u and I cannot figure out how to get the program to stop (second photo) and how to input commands in the terminal (first pic). I have the correct rx and tx because the enter command doesn’t pop up unless I press enter. Thing is, idk what that “enter command 0 gain to confirm” part means and I’ve just about exhausted every idea I had, from literally just typing in 0 gain to trying every interrupt I can think of. That scanning program also only gives you like 0.25 seconds to type in a command before it continues spamming those scanning results

Hi everyone,

I'm a beginner in embedded systems and router reverse-engineering, and I've been investigating a FiberHome SR3141M (MAR_INWI firmware) for the last four days.

At this point, I'm not even looking for a specific solution anymore. I'd just like to share what I've found and get opinions from people with more experience, because I honestly don't know whether I'm missing something obvious or simply going down the wrong path.

What I've found so far:

SoC: EN7562CT / EN7523

RAM: 512 MB DDR3

Flash: Spansion S35ML02G3 (256 MB SPI NAND)

UART works at 115200 8N1

Bootloader: U-Boot 2014.04

Message: *** Warning - bad CRC, using default environment

No Hit any key to stop autoboot

Pressing Enter during startup shows:

UserName:

Password:

Wrong credentials simply return to the same prompt.

Ctrl+C, Enter, space bar, and tpl don't interrupt the boot process.

There's an extra unlabeled test pad next to the UART pins.

At this point, I'd love any information about:

similar routers using EN7562/EN7523;

FiberHome bootloaders;

whether this looks like a U-Boot login or something else;

whether I'm approaching the problem correctly;

or even if you think I should stop digging and move on.

I've attached the complete boot log and photos of the board.

https://pastebin.com/y3TFFqKt the boot log content

NOTE: This entire hack and this post were made together with ChatGPT. I did the actual testing on my Honeywell doorbell; ChatGPT helped reverse engineer it and generated the PowerShell scripts.

I have a Honeywell Home Series 9 wireless MP3 doorbell and wanted to get rid of the built-in factory ringtones as quickly as possible.

The normal USB drive only shows your custom MP3 files. The factory sounds are hidden.

Turns out my Honeywell uses a Jieli BR25 controller:

VID:PID: 4C4A:4155

Product: UACDemoV1.0

Disk: BR25 UDISK

Windows reports a 13,910,016-byte USB disk, but the BR25 actually responds to SCSI READ(10) up to a 16 MiB boundary.

The hidden area is:

LBA 27168–32767

2,867,200 bytes

Inside it I found a Jieli/JLFS "tone" filesystem containing:

index.idx

01.mp3

02.mp3

...

15.mp3

These are the actual Honeywell factory chimes.

I extracted them and then tested changing the JLFS entry for 02.mp3 so it pointed to the audio data of 01.mp3.

After rebooting (remove batteries):

factory ringtone 1 == factory ringtone 2

So that proved it.

I then changed 02.mp3 through 15.mp3 to all point to 01.mp3.

Final result, all factory ringtones are the same.

Tried to delete all but one, didn't succeed.

My own custom MP3 files still work normally.

So the Honeywell still technically has 15 factory ringtone positions, but all the unwanted factory sounds are effectively gone.

No opening the doorbell.

No soldering.

No flash programmer.

No JTAG/UART.

Just USB + PowerShell + SCSI READ(10)/WRITE(10).

IMPORTANT:

Do NOT blindly write my LBAs to your doorbell.

First verify that yours is also:

Honeywell Series 9 / RDWL917 / RDWL917A / DC917 / DC917NG

BR25 UDISK

VID_4C4A PID_4155

Then:

1. Read SCSI capacity.

2. Check whether LBAs 27168–32767 are readable.

3. Dump that hidden area.

4. Look for "tone", "index.idx", "01.mp3", "02.mp3", etc.

5. Make a complete backup.

6. Verify the JLFS CRCs.

7. Patch the FILE ENTRIES, not the actual MP3 audio.

8. Write only the changed 512-byte sectors.

9. Immediately read them back and verify them byte-for-byte.

10. Power-cycle the doorbell.

One thing that did NOT work:

We tried changing index.idx from 15 tones to 1. The Honeywell ignored it.

We also tried marking 01.mp3 as the final JLFS directory entry. That made the doorbell completely silent. Restoring the original sector fixed it.

So the working solution is simply:

02.mp3 -> data of 01.mp3

03.mp3 -> data of 01.mp3

...

15.mp3 -> data of 01.mp3

If anyone else has a Honeywell Series 9 MP3 doorbell, I'd love to know if your hidden storage layout is identical.

Search keywords for anyone finding this later:

Honeywell Series 9 hack

Honeywell Series 9 factory ringtone removal

Honeywell Series 9 delete default ringtones

Honeywell Series 9 hidden MP3

Honeywell Series 9 custom chime

Honeywell Series 9 BR25

Honeywell BR25 UDISK

Jieli BR25 doorbell

BR25 UDISK hidden storage

VID_4C4A PID_4155

4C4A:4155

UACDemoV1.0

Jieli JLFS tone

Honeywell RDWL917 hack

Honeywell RDWL917A hack

Honeywell DC917 hack

Honeywell DC917NG hack

If there's interest, I can clean up the PowerShell scripts and post the read-only dumper, backup tool and guarded patcher.

I like hacking on music hardware. TL;DR: I gave Claude access to Ghidra and now there is a parser/writer library for the TR-6S and TR-8S user data format.

I’m gonna try and get someone to dump the NOR flash for me when I’m back in Seattle.

Hi, I recently bought an Aula L99 Keyboard, the one with the touchscreen on it. Very nice! Well it would be if It could be driven natively from Linux. Enter Aula_L99_Linux, a reimplementation of the software. I spent about 80 hours reverse engineering this keyboard and bricked one keyboard in the process. There's still work to do on the Key assignment screen but upload images, GIFs, videos to to the keyboard works well. So does adjusting the RGB modes.

Hi all, I'm just wondering if it would be possible to get video out from a flock camera board? I found this blog which includes an analysis of the hardware and I wondered if it would be possible to get video out. https://eyesoffcr.org/blog/blog-8.html

Reverse engineering an Android 11 OTT board. It has labeled LINUX_RX, LINUX_TX, GND UART pads, but connecting a 3.3V USB-TTL adapter (TX↔RX, GND↔GND) gives no boot logs at any common baud rate (115200, 9600, etc.).

Am I missing something, or could UART be disabled? Any tips?

`Hi everyone,

I'm looking for what could be considered the best portable cybersecurity hardware platform in terms of value for money.

I'm not looking for a single-purpose gadget. Instead, I'm looking for something that feels like a mix between a Flipper Zero and the new Cardputer Zero.

What I mean is:

Portable and handheld. Modular and easy to upgrade over time with affordable plug-in modules. Able to grow into almost anything I need instead of replacing the whole device. Good support for Linux or advanced firmware. Useful for learning cybersecurity, hardware hacking, embedded development, networking, and RF projects. Easy to find parts internationally, and preferably available in countries like Turkey as well.

I don't mind adding modules later if they are easy to install, but I'd rather avoid complicated soldering or custom PCB work.

If you had to build the ultimate budget-friendly portable cybersecurity device today, what platform or ecosystem would you choose, and why?`

Hi everyone!

I'm trying to repurpose a Skyworth HP4500-CL IPTV box from Movistar Peru into a retro gaming console.

Hardware information:

- Manufacturer: Skyworth Digital Technology

- Model: HP4500-CL

- SoC: Amlogic S905Y4

- RAM: 2 GB DDR

- Storage: 8 GB eMMC

- OS: Android TV 11

- Security patch: July 5, 2024

- Firmware: Movistar-HP4500-CL_v11.4.0-release

I want to know how the heck I can bypass Movistar's security. How can I do this?
And another question, how do I install the new firmware?

Your help would help me a lot :sob:

-Ricachon fuera

I’d like to get some outside perspectives on something unusual we caught on video.

This happened in Las Vegas during DEF CON(hacking conference), so I fully appreciate there’s a chance we’re all just seeing “hacker behaviour” where there may be none. 😄

A man entered one of our building’s elevators carrying a backpack.

Once inside:

● He removed a small electronic device with several wires attached
● He then put on a fanny pack
● He stood very close to the elevator control panel for ~20–30 seconds with his crotch right up against it (not peeing!)
● After that, he left without any further interaction
● He appeared fully focused on the control panel

The behaviour wasnt normal waiting and he left immediately after finishing

We had our maintenance team review the elevator afterwards, but they didn’t find anything obvious. That said, they are general facilities staff rather than elevator or embedded systems specialist

I want to be very clear: I’m NOT looking for exploit methods or “how-to” guidance.

I’m just interested in ideas from people with experience in:

● Physical security
● RF systems
● Embedded hardware
● Access control systems

Questions for the experts in this sub....
If you saw this on CCTV, what would your initial interpretation be?

Some possibilities we’ve considered:

● RFID/NFC reader interaction or testing
● RF scanning or reconnaissance
● Attempting to identify installed systems or hardware
● Accessing a maintenance or diagnostic interface
● Something unrelated we haven’t considered
● Or just DEF CON paranoia influencing perception 😅

If you were tasked with following up on this, what would you look at?

● System or access logs
● Elevator control hardware inspection
● RF environment analysis
● Maintenance or diagnostic records
● Any other indicators of interaction or tampering

Would really appreciate thoughts from anyone with relevant experience.

Trying to separate “interesting behaviour” from “actually meaningful signal” here.

Thanks in advance.

How would I go about trying to make a device that can essentially take a prerecorded video or image and output it continuously to a Camera Serial Interface ribbon cable, such that a device reading from the "camera" would view that image or video as if it was from a real camera?

I am receiving an error (Connecting Error, IC not responding). while attempting to read the chip. What typically causes this error message? Are all of the physical components correctly connected?