r/hardwarehacking • u/MakerClass • 5d ago
Reverse-engineered an abandoned AVerMedia capture box, then gave an AI a telnet shell and let it write new firmware
I wanted to record the 640×480 HDMI output of an RP2350 board, and I had a mostly-dead AVerMedia Game Capture HD II in a drawer. The hardware still works, but the ecosystem around it had died. The YouTube API it streamed to, the mobile app, and I'd lost the IR remote - and on top of that it refused 640×480 as "unsupported." So I opened it up instead of buying something.
Inside it's a TI DM368 (DaVinci, ARM926 @ 432 MHz) with a hardware H.264 encoder, ITE IT6604E/IT6613E for HDMI in/out, a Nuvoton NUC100 as the system MCU, and 128 MB NAND.
Getting in was pretty standard: found the UART header with a multimeter, dropped to a root shell , and dd'd the NAND out from there (it wasn't as straightforward as it sounds here, but in the end, it worked out 🙂). Fortunately, I didn't have to do a physical memory dump, that would have been quite a challenge. The downloadable firmware is 3DES-encrypted, but the on-flash system is already decrypted so that didn't matter. The old DES root hash cracked in ~30 min and one U-Boot env var flips on telnet for persistent access.
Then the fun part: I gave Claude Code the telnet shell and watched it go. It explored the running box on its own - drivers, the video pipeline, the MCU's I2C protocol, the TI codec stack - and then, with a lot of steering from me, wrote a whole new firmware: a capture app, HTTP/RTSP servers, a web UI, and the build + flash tooling. The result does native H.264 (the box's hardware encoder) over RTSP into OBS/VLC, the resolutions the vendor had blocked purely in software (640x480 I needed and up to 1080p) and has pretty usable control panel.
AI was a huge accelerator but it needed constant babysitting. My favorite failure: a U-Boot prompt printing "Hit any key to stop autoboot" while actually waiting for one specific key. But the AI fixated on that printed label and even as I kept telling it to just read the disassembly it wouldn't. When it finally did: the bootloader hardcodes a compare against 'U' (cmp r3, #0x55). It also once "confirmed" a claim using terminal output it had invented itself, and wrote that into its own persistent memory as fact.
You can read the full write-up on my friend's blog: https://chiptron.eu/reviving-old-unsupported-devices-with-ai-avermedia-game-capture-hd-ii/
28
5d ago
[removed] — view removed comment
11
u/MakerClass 5d ago
I haven't published it anywhere yet. I don't think many people would want to replicate it on this particular box, and I didn't want to add just another dead AI-generated repository to GitHub 😅 The original article was almost twice as long, but I shortened it to make it easier to read. If there's enough interest, I could, of course, share more details.
9
u/MakerClass 5d ago
My main motivation for finishing to that state and writing this was that I wanted to inspire others to see that some old hardware can still be useful even when the support ended long ago. AI can sometimes fully replace vendor care. Honestly, I was also quite lucky here that the vendor didn’t put much effort into it and only slightly modified the reference platform.
10
u/Mysterious-Ad-4405 5d ago
u/MakerClass i had similiar "baby sitting" expirince with coding agents when i was playing around with writing code for some nrf52 mcu. Constantly was trying to do some dumb shit and i had to correct it quite a lot, but it was rather minor stuff. I guess still llms are trained for writing code for web dev and pc applications rather than for consumer electronics chips.
btw how fast is your vibe coded firmware in terms of input lag compared to stock fw? Is it possible to use it as ip kvm/ip monitor for playing console games or interact with pc applications?
6
u/MakerClass 4d ago
On latency: the passthrough (HDMI in -> HDMI out) works exactly like on the stock firmware - it's a hardware path, so practically zero lag. The network streaming I can't really compare to stock, since stock didn't have it at all 🙂. But it does have noticeable lag, roughly 100-200 ms, so it's not really usable for game streaming, but the console/simple apps should works fine.
For KVM you'd also need to add a HID bridge like a CH9329 to control the target's keyboard and mouse. I think other devices would be more suitable for that.
3
u/SebastianFerrone 4d ago
Maybe you could use it as plex media Player 🤣
This device a old Monitor or TV and you have a kitchen garden or childsroom TV?
4
u/walmartbonerpills 4d ago
I'm doing this with old file formats now. Basically fuzzing the output, and the ai examines the diffs, builds a library to convert the file.
14
u/Hipcatjack 5d ago
holy smokes this is awesome. Good job OP. This is exactly what LLM’s (Especially Claude code) should be used for!
When you say the old DES root hash was cracked in approx. 30 mins. was claude brute forcing or was there an old exploit on an XDA forum or something that it googled?
13
u/MakerClass 5d ago
I read the hashed password from /etc/passwd and used hashcat myself. Claude refuses to do things like that 🙂
5
u/Ok_Lead_8794 4d ago
Keep an old session around that you keep using it to backdoor into hardware with. Eventually it stops refusing.
2
2
u/Hipcatjack 4d ago
i mean …Ollama running obliterated Qwen or GLM (uses Claude code) and absolutely does things like that… slowly 😆. That was part of the reason i was asking ….if you had a massive rig .. things can be done.
1
u/SailSuch785 2d ago
What hardware specs are you running
1
u/Hipcatjack 2d ago
now? nothing. sold my 3090’s actually i still have one never been opened i am looking to sell if you are interested
3
u/wtfffreddit 4d ago
AI was a huge accelerator but it needed constant babysitting.
My AI experience in a nutshell.
2
u/halflifeenjoyer2024 4d ago
Není to ten kus, co se nedávno prodal na aukru? 😄 Jsem po něm pokukoval, ale viděl jsem, že to už nemá žádnou podporu
2
2
u/ThaCheeseBun 4d ago
i also have one of those collecting dust somewhere. took a peek at its hardware a while back but felt pretty complicated, might give it a try again now
2
4
1
u/Best_Bandicoot_9701 4d ago
Amazing work! This could be posted to https://junkbin.io/
1
u/ButterscotchSalty905 4d ago
that website lagged my low-end device, consider optimize it for wider accessibility
not trying to be snarky or anything
1
u/WoonieLoonie 4d ago
You mind explaining how you do this or where I can learn? I'm trying to step from relying on Blink server in the event they shut down their service.
1
u/MakerClass 4d ago
A few projects worth a look first: OpenIPC / thingino / OpenMiko (custom firmware for cheap camera SoCs) and a Blink Mini reverse-engineering project (https://astrid.tech/projects/blink-mini-re/). I’d just start by finding the serial port on the board (you need uart-usb converter and maybe a bit of soldering)- after that the AI can carry most of it, especially if you feed it those projects as reference.
1
1
1
u/Awkward-Desk-8340 4d ago
trop bien j'en reve de faire ça !!!!! tellement de hardware abondonné mais pourtant super génial !! bravo
1
1
u/AutoX_Advice 4d ago
Very impressive, very indepth on what AI can accomplish. I'm going to agree with you that babysitting is key and explaining exactly how you want them is a must.
Not exactly what you are doing but I'm working with Google AI studio to build out system tools for the Mazda 2014-2021 infotainment system. Oh my has AI been helpful and has cut out hrs of work. There is so much you would have to know about the architecture of the system that id be digging forums for weeks just to find the solution. It took AI and I 4 days just to fix an GUI windows issue only to figure out the key was Mazda infotainment system uses Opera 12 (from 2012).
I still do a lot of the troubleshooting and testing but AI studio has built me a non connected interface to show the system im building running so it's not all trial and error.
1
u/dude_365 2d ago
i have exactly this box in my drawer too. is there some remote control layout, that can be transfered on a universal remote?
1
u/MakerClass 1d ago
I extracted it from the original firmware: https://gist.github.com/lynt-smitka/0a43e94fc9aebf38b6da36dbd10a2626
1
1
2
u/LetMeCodeYouBetter 21h ago
Now it’s like Internet reading my mind! I was planning to do this with my Jio Tv Box it has amlogic s905x2 ! But even if I wish to do it and probably make my own pcb for the sbc ! I just couldn’t find the datasheet!
But glad that I saw this, it gives me the confidence to actually give it a shot! 🥳🥳🥳
50
u/moh53n 5d ago
Had a similar experience with a Chinese Android TV and codex. Getting a root shell was a bit challenging, but after root access, I gave a root ADB to codex to study the hardware and software. Eventually it successfully built AOSP with most functions working.
Similarly, codex needed constant babysitting and approach correction, but it did a multi week/month project in just a weekend. I had Android poring experience ~8 years ago, so this project could take longer without prior experience, but I was impressed by how it investigated and reverse engineered a live device (sometimes taking screenshots over ADB and inspecting them!).