r/ReverseEngineering

▲ 397 r/ReverseEngineering+1 crossposts

Yamaha MA-3/MA-5 FM chip (SMAF ringtones): emulated from scratch in C++, no ROM dump

the ma-3 / ma-5 (ymu762 / ymu765) is the fm chip yamaha put in tons of early-2000s phones: nokia, sharp, samsung, panasonic. same family as the opl/opn chips behind adlib and the genesis, just smaller. it plays smaf ringtones (.mmf), and millions of these files are still floating around.

no datasheet ever came out. nothing public about how the synth actually works. so this got built purely from listening to real files and comparing.

a few things that turned out to matter:

early phones and later ones use two different formats for the same kind of song, with a different note offset. the only public reference gets that offset wrong by two octaves. copy it and every early tune plays too high.

the chip locks in each note's sound the moment it starts. some files change a channel's sound a few ticks late, while the note's already playing. handle that wrong and the start of the song sounds out of tune.

vibrato and how notes fade in and out aren't optional extras. skip them and it plays the right notes but sounds flat and dead.

some files also hide their drum sounds in a separate part of the file. miss that and the drums just don't play.

tested against a few hundred real ringtones. apache-2.0, c++, no dependencies, already running in an existing music player: FXChainPlayer.

repo: https://github.com/akustikrausch/yamaha-smaf-player

u/Dangerous-Section567 — 2 days ago
▲ 204 r/ReverseEngineering+2 crossposts

Redundancy seen in AAA game engines

Ever wonder what the compiler actually spits out when you use those generic math library functions for every single case because you couldn't be bothered enough writing a specialized, hardcoded implementation?

I've been reversing game engines to study how they constructed their fundamental Transformation matrices and handled temporal jitter logic when I spotted a lot of avoidable overhead and "over-engineering" across multiple engines, the main culprit being the heavy, general-purpose math wrappers being used everywhere for every little thing... That said expect no performance gain this is simply for fun that I wrote this blog!

I’ll theorize how the original C++ code was written, show the unoptimized reality of what the compiler spat out, and then showcase how it could have been better optimized.

zero-irp.github.io
u/zer0_1rp — 4 days ago
▲ 43 r/ReverseEngineering+2 crossposts

Claude Code / Codex Skill for Reverse Engineering

I am releasing my Codex (and Claude) Skill for reverse engineering Apple binaries! This is an update and name change to my ghidra-re-skill. I am hopeful other people can contribute! Cerberus RE is a local Apple-focused reverse-engineering workbench for building a repeatable three-headed static/dynamic/instrumentation loop around Ghidra, LLDB, and Frida.

It is most powerful when paired with long-run-agent-skill for managing state and durable, evidence based reasoning.

What is it useful for?
It’s useful for security research, figuring out how to work with private/undocumented frameworks, decoding schemas, etc. I have been using it to build an IDE for Shortpy, a python representation for shortcuts that Apple created in the latest beta. This tool has been paramount for figuring out the classes for implementing features. I’ve also used it to decode things like protobuf blobs which are common in Apple DBs and are normally opaque in their meaning.

github.com
u/FiendForMath — 3 days ago
▲ 103 r/ReverseEngineering+3 crossposts

VMware vTPM-encrypted vmem/vmsn decryption ready for volatility3

Recently I ran into a problem: I needed to analyze a VMware snapshot of a Windows 11 25H2 VM, but the VM had a vTPM, which makes VMware silently encrypt the .vmem/.vmsn/.vmss/.nvram. Volatility just couldn't find the kernel, and I couldn't find any existing tool to decrypt these files for offline analysis.

So I reverse-engineered the format with the help of Claude and wrote one. It's called vmem-decrypt (pure Python):

- Recovers the data-file key from the VM password (PBKDF2 → AES-256-CBC key chain VMware labels everything "XTS-AES-256" but it's actually CBC, which trips up most people).

- Decrypts .vmem/.vmsn/.vmss/.nvram.

- Flattens the decrypted .vmem into a flat, Volatility-ready image. (VMware compresses then encrypts, so it's still in a proprietary checkpoint LZ77 layout)

Workflow: pull the password hash from the .vmx (VM-Password-Extractor) → crack with hashcat (mode 27400) → feed the password to the tool → run Volatility. Full steps + format notes in the README.

Tested on VMware Workstation Pro 26H1 / Win11 25H2 (build 26100), Volatility 3. Feedback welcome, especially snapshots from other VMware versions to test the format against.

Repo: https://github.com/heeeyaaaa/vmem-decrypt

(Yes, I used AI to help build this. It's tested and it works, that's what matters. Happy to walk through any part of how it works.)

u/h_e_e_y_a_a_a — 5 days ago
▲ 112 r/ReverseEngineering+6 crossposts

TRAWL: Self-hosted scraping engine — bypasses any JS challenge & captcha: Cloudflare, Turnstile, reCAPTCHA, hCaptcha, GeeTest. FlareSolverr & Byparr alternative and drop-in replacement for your *arr stack.

github.com
u/Germond_ — 6 days ago
▲ 68 r/ReverseEngineering+8 crossposts

NOOP v4 — use your WHOOP band with no subscription, no account, fully offline (Mac · iPhone · Android) Now supports more than just WHOOP 4/5!

Short version: if you own a WHOOP, the band is dead weight without a ~$199–$359/year membership, and all your data lives on their cloud. NOOP is a free, open-source app that talks to your WHOOP directly over Bluetooth and gives you recovery, strain, sleep and a lot more — on your own device, no account, no cloud, no subscription. Your data never leaves your phone or Mac.

It's independent and unofficial (not affiliated with WHOOP). It's been going a while — 171 releases, 10,000+ downloads, 1,600+ GitHub stars — and v4 is the biggest update yet.

⭐ Standout features (the stuff that makes people switch)

  • No subscription, ever. Every feature unlocked, no account, no nag. Free forever.
  • 100% offline & private. No cloud, no sign-up — your raw heart-rate and sleep data physically stay on your device. You can export all of it whenever you want.
  • It runs on a Mac. WHOOP doesn't even make a Mac app. NOOP gives you a full desktop dashboard and a menu-bar live-HR readout.
  • NEW in v4 — a longevity engine: your Fitness Age, a Vitality score (0–100) and a Body Age in years, computed from data you already have.
  • Your strap can buzz back. NOOP uses the band's own haptic motor for HRV breathing biofeedback (it paces your breath with felt cues) and a silent HIIT interval timer (buzzes every work/rest transition — train hands-free, no screen).
  • Turn your strap into a remote. Double-tap the band to lock your Mac, mark a moment, or run any macOS Shortcut.
  • Bring your WHOOP history across in ~1 minute by importing your official export — then it's yours.

🆕 What v4 adds — the "Age & Longevity" engine

Three new on-device numbers, all framed honestly as wellness estimates (never a clinical age):

  • 🫀 Fitness Age — how fit your heart is vs your actual age, from resting HR + recent activity, built on the published Nes/HUNT VO₂max research. A "How accurate is this?" panel shows exactly which inputs went in.
  • ✨ Vitality (0–100) + Body Age — your longevity read, the way WHOOP's "Healthspan" works: resting HR, sleep duration + regularity, HRV and activity each weighed against published all-cause-mortality research. It even names the one habit helping you most and the one holding you back.
  • 🏃 Optional VO₂max estimate — add a waist measurement and NOOP shows it alongside your Fitness Age.

(v4.0.1, out today, also makes Today's Effort update live through the day instead of lagging, and fixes a sleep-time-edit bug.)

📋 The full feature list

Daily scores — NOOP's own, all out of 100 to go head-to-head with WHOOP:

  • Charge (recovery) from HRV / resting HR / skin temperature / sleep quality
  • Effort (strain), now computed live as your day builds
  • Rest (sleep) composite, with full sleep staging

The screens:

  • Today — home dashboard: recovery ring, a "today's synthesis" insight, stat tiles (recovery, strain, sleep, HRV, RHR, SpO₂, respiratory, steps, weight, calories) each with a 14-day sparkline, live strap battery %, HR trend and recent workouts.
  • Readiness — a "should you push today?" call built on real sports science: HRV vs baseline (Plews/Buchheit), resting-HR drift (Lamberts), respiratory drift, training-load balance (acute:chronic, Gabbett) and monotony (Foster) → one headline (Primed / Balanced / Strained / Run down) with the reasons.
  • Sleep — hypnogram, stage breakdown, efficiency, resting HR & HRV from the on-device sleep stager. Browse back through past nights, and edit bed/wake times.
  • Stress — day-level autonomic-load view. Health — full biometric overview (HR, HRV, SpO₂, skin temp, respiratory rate). Trends — long-range trends across everything.
  • Workouts — detected sessions with strain + HR detail, plus GPS workout tracking with route map, HR zones and a post-session summary. Live — real-time HR/frame stream.
  • Breathe — HRV haptic breathing biofeedback with pre/post HRV outcome (Relax 4-6, Coherence 5.5, Box 4-4). Intervals — silent haptic HIIT timer.
  • Mind — a daily mood check-in correlated against your own recovery/sleep/HRV (on-device, non-clinical).
  • Explore / Compare / Insights — interrogate any metric over time, plot two together, and surface correlations from your own data.
  • Data Sources — one-tap import of a WHOOP CSV export, an Apple Health export, or a nutrition CSV (Cronometer / MacroFactor).
  • Automations — double-tap → Mac action/Shortcut, lock-on-wrist-off, HR-zone haptic coaching, and a smart alarm that arms the strap's own firmware to buzz you awake even if the app's closed.
  • Coach — an optional AI coach you can ask about your data in plain language. It's off until you add your own key (Anthropic, OpenAI, or any OpenAI-compatible endpoint including a fully local model via Ollama / LM Studio) — and it only ever sends a short text summary + your question, never raw data. With a local model the conversation never leaves your machine.
  • Settings — profile, step calibration, units, the in-app What's new changelog, and an opt-in Experimental section.

Also in the box: Apple Health + Health Connect (reads in, writes your workouts back out), steps, strap battery alerts, rename your strap, a live-HR widget / Dynamic Island / Live Activity, raw sensor CSV export, a menu-bar extra on Mac, a first-run onboarding wizard, and a built-in scoring guide that explains every number and how it differs from WHOOP's.

📱 What devices are supported

Platforms — one feature set across all three:

  • macOS (13+) — full app + menu-bar extra.
  • Android (8+) — full app, install the APK.
  • iPhone / iPad — sideload the unsigned .ipa with AltStore / SideStore and sign it with your own free Apple ID (no App Store, no developer account). Newer and a little less battle-tested than Mac/Android.

Straps:

  • WHOOP 4.0 — ✅ the fully supported path: live HR, recovery, strain, sleep, full history offload.
  • WHOOP 5.0 / MG — 🧪 live heart rate works on real hardware; deeper overnight metrics (recovery, strain, sleep) are still being reverse-engineered, and the app tells you straight which ones aren't ready yet. (Note: pairing a 5/MG means closing the official WHOOP app first so it isn't holding the Bluetooth bond — there's a guide in-app.)
  • Multiple WHOOPs — manage several straps, switch between them, and see what each band can do.
  • Generic Bluetooth heart-rate straps (Polar and friends) — early support, with a Devices screen and guided pairing wizards.

💡 Why it beats the official setup

Feature NOOP WHOOP app
Cost Free, forever ~$199–$359 / year
Account None Required
Your data On your device, offline Their cloud
Mac app ✅ Yes ❌ No
Export raw data ✅ Yes Limited
Open source ✅ Yes ❌ No

📰 As featured in

AOL · Yahoo · Android Authority · TechRadar · BGR · Android Central · Android Police · Notebookcheck · Trusted Reviews

⬇️ Download (free)

https://github.com/NoopApp/noop/releases/latest

  • macOS: the .zip, or brew install --cask noopapp/noop/noop
  • iPhone/iPad: the .ipa (sideload + sign with your free Apple ID)
  • Android: the .apk

Questions, setup help & release news → r/NOOPApp.

♥ Keeping NOOP alive

Full honesty: NOOP is free forever, every feature unlocked, no nag — and it's built and maintained by one person, out of pocket. Keeping up with WHOOP's hardware and firmware takes real time and real test gear. The project continues if the people who use it help fund it.

Donations are crypto-only, on purpose — it keeps the project (and you) anonymous, no names attached. If even a small fraction of those 10,000+ downloads chipped in $50 (a fraction of one year's WHOOP membership), NOOP's future is secure for a long time:

  • BTC: bc1qn2gkl7wslwpws06mvazjn2uu689zlkv7kg3kf5
  • ETH: 0xd64D508b531c4b1297Ca4023C774e0E97aA67B7F

New to crypto? Cash App / Coinbase / Kraken will have you sending in ~2 minutes. Thank you for keeping an independent, no-subscription project alive. 🙏

github.com
u/TheNoopApp — 6 days ago
▲ 20 r/ReverseEngineering+3 crossposts

WinPE as a stateless harness for Windows driver testing and fuzzing

Eliminate the overhead and lack of idempotency of a full Windows system in automated testing. A practical guide to configuring WinPE and QEMU for lightning-fast boot, automating kernel debugging, and avoiding KDNET pitfalls.

bednars.me
u/Acanthisitta-Sea — 7 days ago