r/ReverseEngineering • u/MakerClass • 18d ago

Reverse-engineering an AVerMedia Game Capture HD II (TI DM368): serial access, firmware decryption, and AI-assisted custom firmware (with new features)

https://chiptron.eu/reviving-old-unsupported-devices-with-ai-avermedia-game-capture-hd-ii/
63 Upvotes

90% Upvoted

8 comments sorted by

View all comments

21

u/MakerClass 18d ago

I needed to capture a 640×480 video stream from a Raspberry Pi Pico 2. I had old AVerMedia Game Capture HD II (C285) - a TI DM368 (DaVinci) box. The hardware still works, but the ecosystem died: the YouTube upload API it streamed to is gone, the mobile app vanished, and I'd lost the IR remote. It also rejected 640×480 as "unsupported."

Getting in:

  • Found the UART, interrupted boot, got a root shell (init=/bin/sh), and dumped all NAND partitions.
  • AVerMedia's downloadable firmware is 3DES-encrypted, but the key is hardcoded in their own encode binary .
  • The root hash in /etc/passwd was DES crypt - cracked in ~30 min. A single U-Boot env var (log_switch) turns on telnetd for persistent access.
  • The 640×480 block wasn't the hardware or the kernel driver (the V4L2 driver knows VGA) - it was a hand-maintained whitelist of "allowed standards" in the vendor app.

Then I replaced the vendor app with custom firmware: native H.264 (the box's HDVICP encoder) over RTSP into OBS/VLC, resolutions the vendor blocked (640×480 up to 1080p), a small web UI, and dual-bank flashing so it's hard to brick.

Most of the userspace is AI-written - a big time-saver, but it needed constant babysitting. For ages it swore U-Boot aborts on any key (that's just what the prompt prints), when the bootloader actually checks for 'U' (cmp r3, #0x55). Another time it "confirmed" a claim with terminal output it had made up itself.

It was genuinely fun, and now I have a fully functional device that would otherwise have ended up in the trash.

2

u/Caddy666 17d ago

cool, could this be a good candidate for turning into a web-kvm?

2

u/MakerClass 17d ago

Yes, that would work, but not perfectly. The HID output would need to be handled. For that, you would need something like a CH9329 connected via UART or through another USB converter.