For now, I’ve created a dump from the platter that was no longer capable of updating. I want to run the emulator available on GitHub to learn how Linux works.

https://github.com/quarkslab/starlink-tools

Has anyone here—other than the people involved in the GitHub project—done this already?

#starlink

Hi everyone,

I have an old 7-inch tablet (HCL ME Sync 1.0) from around 2013 sitting in my drawer. It runs Android 4.1, has 512MB RAM, and a 1GHz single-core processor.

The battery seems completely dead or in a deep sleep. Since I don't want to use it portably, I want to convert it into a small, low-power local home server or kiosk (maybe to host a basic dashboard, a simple script, or just experiment with headless Android).

The problem is: I have never done hardware hacking, soldering, or battery modifications before. I am a complete beginner.

I have two main questions for this community:

1. Hardware/Safety: Leaving this plugged into the wall 24/7 with a dead battery is a fire hazard. Though I somehow removed the battery {idk whether in a safe way or not}, can you tell me how to wire it to run directly off USB/wall power? What tools and cheap components (like a buck converter or diode) would a beginner need to do this?

2. Software: With Android 4.1 and 512MB RAM, what are some lightweight server projects or linux-deploy options that could actually run on this device without crashing it?

Any step-by-step guides, advice on where to solder, or warnings for a first-timer would be highly appreciated! Thanks in advance.

Hey all. I found my way into about 300 or so identical 500GB solid state drives. Neat. I noticed they have 2 unpopulated NAND pads. Want to see if I can remove nands in one drive and add them to another to give me 1TB drives. Because storage space is so cheap right now! Been making good progress I believe so far. I created a little github page to document to process if anyone is interested in updates. Anyone try anything like this before? I just really needed an excuse to clean up my bench and play with some hot air lol

https://github.com/Robot-Snow-Shoes/FrankenSSD/

This is garbled text and I try on multiple vaud rates on UART, does anyone know the correct port and baud rate for this charger? Trying to get a Linux shell. It is a BP Pulse Home Charger Smart. Thanks in advance!

Hi all,

I didn't really see much open-source PD firmware for cheap power meters, so I decided to take matters into my own hands and wrote my own. It's mainly for the KOWSI KWS-X1, but I purposely split it into 3 repos so other people can adapt it to their own devices:

• kws-x1-standalone-rs: the actual firmware for the meter (screens, buttons, settings, the PD sink logic) https://github.com/kralonur/kws-x1-standalone-rs
• hc32f460-embassy-rs: an async Embassy HAL for the HC32F460 chip the meter runs on, usable on any board with that MCU https://github.com/kralonur/hc32f460-embassy-rs
• embedded-charging-protocols-rs: no_std USB PD protocol bits that don't care which chip you use https://github.com/kralonur/embedded-charging-protocols-rs

It does the usual meter stuff: voltage, current and power, plus asking the charger for a fixed or PPS voltage. It also has a 5A cable test, and it remembers your settings after a power cycle. The part I'm happiest with is how much PD info it shows. Most cheap meters just say "PD 20V" and that's it. This one shows the charger's full offer (EPR included), its ratings and live status, and the cable's e-marker decoded field by field. It also shows every step of the negotiation, so when a charger acts weird, you can actually see where. You can also put it between a charger and your phone and watch what they say to each other. The full list is in the README.

Now the honest part, because it definitely has its minuses. It's PD only for now, so no QC, AFC or FCP. It can see EPR offers but can't actually go above 20V yet. There's no mAh/Wh counting, no graphs, no logging and no app, and there's no calibration setting either. It forgets your chosen voltage on reboot and always starts at 5V, and flashing only works from Linux right now. I've also only tested it with the chargers and cables I have, so there are surely bugs I haven't hit yet.

I'm planning to add EPR, QC and other protocols in the future, but I can't put all my time into this project, so it will go step by step. That's the good part of open source, though: anyone can jump in and contribute or change the code however they like, and PRs are very welcome.

Getting into the bootloader is easy: hold Back + OK while plugging it into your PC. The README has the full flashing steps and a checklist for testing it by hand.

Disclaimer: Flash at your own risk. I'm not responsible if you damage your device.

AI disclaimer: I used AI tools while working on this. Credit where credit's due. That said, this is far from a vibe-coded project. I followed the official documentation the whole way: the USB PD spec, the chip datasheets and the HC32F460 reference manual. The code isn't a 1:1 copy of those docs, but every protocol value and register setting comes from them, not from guessing. I also tested everything on the real device myself as much as I could.

Some questions I expect:

Why tho?

Why not. The KWS-X1 was cheap enough and capable enough to show a lot of data and talk PD properly, so it made sense.

Will it work on my meter?

If it's a KWS-X1, yes. If it's something else, not necessarily, but that's exactly why the repos are split. If your meter uses an HC32F460, the HAL repo is a good start. The PD protocol repo doesn't care about the chip at all.

Can I go back to stock firmware?

Yep, I tested it myself. To enter the bootloader, hold Back + OK while plugging it into your PC, and then flash the stock image back. Everything worked, triggering included. I found the stock firmware through this blog post: https://tomoca2.hatenablog.com/entry/2026/02/15/221952 (just to be clear, I'm not associated with the author in any way, I just found it useful).

Why Rust?

Idk I like the language and I wanted to. Embassy also makes embedded development really pleasant, and Rust's type system catches a lot of mistakes before they ever reach the device. PD has plenty of states you really don't want to get wrong.

Git history not that old?!

Yep. At first, I did everything in one monorepo, with all development in one place. It got messy, and the history ended up being hundreds of messy commits. Separate repos with a clean history just made more sense.

Repo: https://github.com/kralonur/kws-x1-standalone-rs

So this is what I've got so far. Happy to hear feedback.

Edit: Added cross compiled flasher

Edit 2: Ready-to-flash firmware is now available too, so you don’t have to build anything. Download the firmware and the flasher for your OS, verify the checksums, and follow the README. No installation needed.

Both under: https://github.com/kralonur/kws-x1-standalone-rs/releases/

It finally happened: I successfully paired and set up an Apple Watch from scratch directly on my OnePlus, Linux and Windows laptop,— zero iPhones involved. ⌚️⚡️

I honestly didn’t expect this insane amount of encryption layers when I started. It took 3 solid months of reverse engineering to break through it.

Under the hood, the implementation isn't device-specific. It should work on any Android phone, and in theory, even on macOS, Windows, or Linux (planning to test those environments later). Right now, I’m actively writing the companion code to bring feature parity as close to 100% as possible.

PoC video and source code will be published soon.

Just genuinely curious: am I actually the first person to pull this off, or did I somehow miss someone else's work? 👀

After extensive logic analysing I came to realise that the panel has a basic init sequence and some SPI's that had to be fulfilled, and once fulfilled it works almost perfectly! I have decided which pins are responsible for blue and green brightness, but have only gotten some red pins. This should take me some minimal time, and as mentioned previously, I will be making all info I have gathered open-source to who it may help. Sorry for the bad photos of the LCD so far, it's just a bit hard to orient it with so much wiring. I hope you all understand :)

Could someone with Keil C51 build a small open-source 8051 project for me?

I'm fixing a power-off bug on an Android car head unit (CVD1810-WJ board, Cmsemicon CMS8S6990 MCU).

There is an MIT-licensed rebuild of its firmware:

https://github.com/NCHILLC/cvd1810-wj-mcu-firmware

The author states it only fits the chip's 12 KB with Keil C51 at OPTIMIZE(9,SIZE). The evaluation linker stops at 2 KB and SDCC gives about 15 KB.

With Keil C51 at C:\Keil_v5, from the repo root in PowerShell:

mkdir obj, lst; .\build_variant.ps1 -Define NOTURNO_SLEEP_FIX

It should report about 12.2 KB and write obj\CM68.hex. Could you send me that file and the "Program Size" line it prints?

Hi guys! I made something pretty unusual, and I wanted to share the story with you!

Last week, something terrible happened to my PC. A 12V wire touched a 5V wire, and unfortunately, my PSUs didn't have the protection needed to prevent a disaster. I lost my Gigabyte X99P-SLI motherboard, a 500GB SSD, and two of my XFX RX 580s...

I was devastated. I'd bought these components just a week or two earlier, and electronics prices in my country had gone through the roof. Building a local AI machine with four used XFX RX 580s and that motherboard was pretty much my only affordable option.

But honestly, it was an amazing machine for the price! I was getting around 30–35 tokens/s during generation and 250–350 tokens/s during prompt processing, even with at least 160K context, running Ornith 1.5 35B, a Qwen3.6-35B-A3B variant.

Everything was going perfectly until those two wires fell in love... and their love was so hot that they blew up half my PC. 💀

During my desperate attempts to recover the hardware, I discovered that both GPUs were actually healthy, except for one thing: the BIOS chips on both cards were dead! (Error 43 in device manager, no flash utility can flash bios to GPU! even ch341a USB spi programmer cant read / write from / to chip!)

I tried replacing the chips, but I made a mistake during the process and damaged some PCB traces. So, fixing them the traditional way wasn't going to be easy.

Then, after countless attempts and a lot of frustration, something unexpected happened.

Somehow, Claude, ChatGPT, and I (although I actually wrote zero lines of code myself!) managed to build something that I think is genuinely useful.

It's a UEFI application that essentially emulates the SPI flash chip, initializes the GPU's memory controller, and loads the VBIOS into the card.

And the crazy part?

My RX 580s now work even with their physical BIOS chips completely removed from the boards! I actually desoldered them!

How does it work?

You only need the VBIOS files for your graphics cards. That's it!

• Know which VBIOS belongs to your card? Just provide that one BIOS file for each card.
• Not sure which VBIOS is the correct one? You can provide multiple BIOS files, and the loader can try to find the appropriate one.

No physical BIOS chip is required on the GPU. The application loads the BIOS directly into the card during startup.

I've also made a GUI version to make things easier:

GitHub repository: https://github.com/aryan-nikzad/rx580_vbios_loader_GUI

I never expected to turn a hardware disaster into a software project, but here we are!

Maybe this project will help someone else recover a GPU with a dead BIOS chip instead of throwing it away.

What do you guys think? Has anyone tried anything similar with Polaris GPUs?

(I’ve used “VBIOS” and “chip dump” interchangeably here, even though they aren’t necessarily the same thing. Also, ChatGPT helped rewrite this post because English isn’t my native language. Anyway, thank you for taking the time to read it!)

I’m a dentist and own a fläsh teeth-whitening device. It uses a contact chip card to authorize a limited amount of treatment time and operates without an internet connection.

Has anyone successfully reverse-engineered the card system or modified the device to work without purchasing additional time cards?

I’m interested in identifying the chip, understanding how the remaining time is stored, and finding any documented projects or firsthand experiences with this particular system.

My goal is to remove the usage restriction while keeping the device’s treatment settings and safety features working correctly. I can share photos of the card, circuit boards, and component markings.

Any relevant information or links would be appreciated.

I want to build a a mobile phone a secret one with a wifi , mid camera, bluetooth , a good OS ,a bluetooth and a screen obv and can do bank payments (becuz whenever I try to use my phone my parents scolds me )so I am thinking of making one what components to use and can I use this pi zero ?

While working on my Master’s thesis benchmarking WPA3-SAE timing side-channels, I ran into a limitation on the ESP32: esp_wifi_80211_tx() allows raw frame injection, but Espressif’s closed-source Wi-Fi blob (libnet80211.a) artificially blocks Auth, Assoc, Deauth, and Disassoc subtypes.

Inside libnet80211.a, ieee80211_raw_frame_sanity_check drops these frames with wifi:unsupport frame type. Here is how to bypass it on recent ESP-IDF versions (IDF v6.x).

Why standard tricks fail on modern ESP-IDF

Same-name function override: On older IDF versions, ieee80211_raw_frame_sanity_check was a weak symbol (W). On modern IDF versions, it’s a strong symbol (T), causing ld: multiple definition errors.

--wrap linker flag: Fails silently. The call from esp_wifi_80211_tx to ieee80211_raw_frame_sanity_check is an intra-object branch inside ieee80211_output.o. Linker --wrap only rewrites undefined external references, so it misses this call entirely.

Instruction byte-patching: Overwriting instructions directly in the .o breaks Xtensa linker relaxation passes (dangerous relocation errors).

The Fix: Symbol Weakening via objcopy

We can use xtensa-esp32-elf-objcopy to convert the strong symbol inside the binary archive into a weak one:

xtensa-esp32-elf-objcopy \

--weaken-symbol=ieee80211_raw_frame_sanity_check \

components/esp_wifi/lib/esp32/libnet80211.a

Now, define your own strong implementation inside your application C code:

int ieee80211_raw_frame_sanity_check(int32_t a, int32_t b, int32_t c) {

return 0; // which skips the security check lol

}

Because strong symbols override weak symbols globally during linking, all calls—including internal calls within libnet80211.a—rebind to your function.

Verification

Serial Logs: wifi unsupport frame type errors completely disappeared.

Capture: Wireshark confirmed off-air capture of 802.11 Authentication frames (Subtype 11, Algorithm 3 - SAE) injected directly from the ESP32s.

Full Exchange: Injecting a valid SAE Commit (P-256 scalar + element) caused hostapd on the target AP to process the request and reply with its own SAE Commit.

TL;DR: Run objcopy --weaken-symbol=ieee80211_raw_frame_sanity_check on libnet80211.a, define int ieee80211_raw_frame_sanity_check(...) { return 0; } in your app code, and esp_wifi_80211_tx() will allow any frame subtype.