Reverse Engineering Obsolete Hardware and Software to Create Custom Tools

f4mi

The Problem of Obsolete Hardware [0:00]

The video begins by highlighting a pervasive issue in consumer electronics: devices become obsolete not due to hardware failure, but because their manufacturer-provided software or accompanying applications are no longer supported, poorly maintained, or intentionally restrictive. The overarching theme is that users often "own nothing" despite purchasing hardware, as their control is dictated by external software.

• AVerMedia Game Capture HD II [0:09]

  • Released in September 2013, it came with a dedicated app for managing features like direct YouTube and Facebook uploads.
  • Support for the app lasted only 321 days, ending in July 2014.
  • By November 2025, the app was completely removed from app stores, rendering certain device functionalities inaccessible.

• Creative Sound Blaster E5 [0:31]

  • Released in August 2014, this device featured dual audio jacks, digital out, dual-orientation mic recording, Bluetooth, NFC, ASIO drivers, and a battery bank.
  • Control was facilitated by the "Sound Blaster Central" app.
  • Since 2020, the app has been largely broken, with users reporting connectivity and battery issues.
  • Windows drivers often cause Blue Screen of Death (BSOD) errors, forcing users to "roll the dice" with older versions.

• Huion Note [1:56]

  • A digital notebook that captures handwritten notes and instantly provides a digital copy. It also generates timelapses of drawings.
  • The hardware itself is considered impressive for its price.
  • The software, however, is criticized for being "a piece of shit," requiring login with an email (for a notebook!), and adding an undeletable watermark to exported timelapses (on iOS, but not Android, for some reason).
  • On PC and Mac, only basic pen tablet functionality is available, pushing users towards the mobile app.
  • The core problem across all these devices is identified as entirely software-based.

Part 1: A Not So Brilliant Idea – Initial Attempts and Discoveries [3:46]

The creator introduces their personal journey into reverse engineering, motivated by similar frustrations with their own devices.

• Philips Hue Lightbulb [3:52]
  • The initial goal was simple: control a Philips Hue lightbulb via Bluetooth from a laptop for convenience.
  • The official Philips Hue documentation stated that Bluetooth control from a computer was impossible, requiring a separate Hue Bridge for such functionality.
  • Initial Hacking of Philips Hue [4:35]:
    • The creator, being unemployed and broke, chose not to buy the expensive Hue Bridge.
    • They ran the iPhone version of the Philips Hue app on an Apple Silicon Mac (which can natively run iPhone apps) and used PacketLogger to capture Bluetooth Low Energy (BLE) traffic while controlling the light.
    • This revealed the precise commands (UUIDs and values) being sent to turn the light on/off and adjust brightness.
    • Python Script for Philips Hue [5:09]: A simple Python script using bleak and asyncio was created to send these captured BLE packets, successfully controlling the light with one click.
    • Discovery of existing libhueble library [5:16]: A day later, a search on GitHub revealed that developer "alexhorn" had already created a libhueble library that achieves the same functionality, highlighting the collaborative nature of open-source efforts.

Part 2: How to Actually Hack Into Stuff – The Methodology [10:31]

The video then dives into the general methodology for reverse engineering and developing custom tools.

• Understanding APK Files [7:49]

  • Android Package Kit (APK) files, used to install applications on Android, are essentially renamed .zip files.
  • This means their contents can be easily extracted and examined.

• Reverse Engineering AVerMedia Game Capture HD II [11:19]

  • The AVerMedia Game Capture HD II was chosen as a primary target for detailed demonstration because it was cheap (5 Euros on the used market), standalone, and the process of understanding it involved many tools.
  • Decompiling the GameMate App with JADX [12:38]:
    • The gamemate-1-0-25.apk (the official AVerMedia app) was obtained.
    • JADX (Java Android Decompiler eXtreme) was used to easily extract and decompile the Android APK.
    • Identifying API Endpoints [13:22]: By searching for "http" strings within the decompiled code, numerous URLs (API calls) were found, indicating how the app communicates with the device. These included links related to pairing, device name retrieval, remote control keys, and file operations.
    • Network Analysis (Man-in-the-Middle) [15:47]:
      • The concept of a "man-in-the-middle" attack was explained, where a computer running Wireshark intercepts traffic between the phone app and the capture device (connected via a router).
      • This allows observation of unencrypted (HTTP, not HTTPS) plain text data being sent between the two, revealing how they communicate.
      • Discovery of Existing GitHub Repo [16:11]: A GitHub repository by "lkiesow" was found, containing network captures and reverse-engineered API documentation for the AVerMedia Game Capture HD II.
    • Custom Python TUI for Game Capture [16:55]:
      • Using the discovered API structure (IP and Port for commands/queries), a simple Python Terminal User Interface (TUI) was created.
      • This script could pair with the device, navigate its menu, and perform actions like initiating recording and managing files remotely over the network, effectively replacing the original defunct app.
      • A major achievement was the ability to download all recorded videos from the device's hard drive remotely, a feature never explicitly available in the original application.
      • An Electron-based GUI version was also developed for ease of use.

• Reverse Engineering Huion Note [18:36]

  • The motivation here was the desire to use the Huion Note without its intrusive, login-dependent, and watermark-adding official app.
  • Decompiling the Huion Note APK [19:00]:
    • The .ahn files (Huion's Android note format) were found to be renamed .zip files containing images and a 0.page file.
    • The 0.page file was a JSON document describing the strokes (opacity, position, pressure, thickness, color, etc.).
    • Python Script for Huion Note [19:19]: A Python script was developed to read this JSON data and render the drawings, effectively creating a completely offline digital representation of the notes without any watermarks or cloud login.
  • Dynamic Instrumentation with Frida Gadget [19:47]:
    • To understand the Bluetooth communication for live streaming, Frida Gadget was used. This tool allows injecting code into an Android APK to monitor its interactions with the hardware (e.g., Bluetooth I/O).
    • This process, called dynamic instrumentation, makes a "black box" application transparent, allowing observation of all data sent over BLE.
    • BLE Protocol Analysis [20:15]: By comparing captured BLE packets from different drawing actions (e.g., changing pressure or coordinates), patterns were identified (what stays fixed, what changes).
    • Custom Web Application for Huion Note [20:56]:
      • A free, open-source web application, takingnotes.ink, was created.
      • It connects to the Huion Note via BLE, streams live drawing data, renders it without watermarks, allows offline saving, and even exports timelapses at custom resolutions and frame rates.
      • This effectively replaces the entire functionality of the original app with a superior, user-controlled solution. The project used ported code from "tuhi-project" on GitHub for the Wacom side.

• Reverse Engineering Sound Blaster E5 [23:10]

  • The Sound Blaster E5, despite its advanced features for its time, suffered from terrible Windows drivers and a problematic mobile app.
  • USB Packet Sniffing [24:06]: Wireshark was used to capture USB data while interacting with the official Sound Blaster control panel on Windows.
  • Analyzing USB HID Commands [24:44]: By pressing every button and moving every slider in the control panel, corresponding USB Human Interface Device (HID) commands were recorded.
  • Custom Web Application for Sound Blaster E5 [25:51]:
    • An open-source web application, soundcard.click, was developed using the acquired knowledge of the USB HID protocol.
    • This web app provides comprehensive control over the Sound Blaster E5's features (EQ, microphone settings, effects, etc.) via USB and Bluetooth, offering a stable and reliable alternative to the official software.
    • The project also leveraged existing fan-made drivers for other Sound Blaster devices (kgtmaven on GitHub) to ensure compatibility with Windows.

• Reverse Engineering Ultimate Ears Boom 2 [26:47]

  • This Bluetooth speaker, acquired for free, was examined for modding potential.
  • Extracting MP3s from Firmware [27:41]: By extracting the APK for the UE Boom app and renaming it to a .zip, MP3 files were found within the firmware, including sounds for startup and shutdown.
  • Custom Update Tool [27:52]: A simple Python script called "Sound Factory" was created. This tool allows users to drag and drop their own MP3s to replace the speaker's startup and shutdown sounds, effectively creating a "limited edition" personalized speaker.

Conclusion: Hack Everything [28:13]

The video concludes by reiterating the core message: "When you buy something, it's yours. You should be able to do whatever the hell you want with it." The entire video serves as a practical guide and philosophical statement on user ownership and the power of reverse engineering to unlock and enhance hardware functionality, even when official support fails. It highlights that with logic, Google, and perseverance, even those without a formal programming background can learn to understand and control their devices.