How to hack Wi-Fi
Hi everyone! I’d like some help with studying ethical hacking. I’d like to learn how to hack into Wi-Fi networks and routers. Could anyone help me?
u/AF_MORGAN1 — 7 hours ago
r/hardwarehacking
iOS won't tell me a BLE device's MAC, so I started reading it out of the vendors' own payloads. What else leaks like this?
CoreBluetooth will not give you a peripheral's Bluetooth address. You get a UUID that the system assigns the first time it encounters the peer, and Apple documents it exactly that way, so on iOS every address-level trick is off the table before you start.
Then I noticed that a lot of devices just hand it over themselves.
Xiaomi MiBeacon, service data UUID 0xFE95, carries a frame control word where bit 4 means "MAC included". When that bit is set, the six bytes at offset 5 are the address, stored reversed. It is right there in the xiaomi-ble parser that Home Assistant depends on, so this is not me guessing at a hex dump. SwitchBot and Govee do their own version of the same thing in their own service data.
So the reliable route to a hardware address, on a platform that deliberately hides it, runs straight through the payload the device is already shouting at everyone in range.
The part I cannot make sense of is that this forecloses address rotation completely. Whatever the link layer does with private addresses, a fixed six bytes sitting in the advertisement hands any passive scanner a permanent handle on the device. I can construct one excuse, that the vendor's app needs something stable to bind against while the address moves underneath it, but that argues for a derived per-vendor id rather than the real MAC.
I am now checking both ends of every service data blob I decode for six plausible bytes, and I am hitting more than I expected to.
Which vendors am I still missing, and has anyone found an actual protocol constraint that justifies putting it there? I would rather be corrected than write it off as sloppiness.
Disclosure so nobody has to check: the scanner is my own iOS app, BLE Scanner. The payload is the interesting part here, not the app.
u/BigBalli — 15 hours ago
Would there be any way of using this camera module?
I got this in a lot of electronics parts off of Facebook marketplace. Im guessing all these parts were ripped from the same camera, but I don't know that for certain.
It looks like the camera module has a positive line, a negative line , and (maybe serial line).
My question:
Would there be any way to ascertain the correct voltage and decoding procedure for this camera, or would the data scheme be proprietary and/or inaccessible?
u/Focused-Inventor — 1 day ago
▲ 25 r/hardwarehacking
ChipWisperer Lite PCB X-Ray
ChipWisperer Lite X-Ray of PCB...
u/Rhine_Labs — 1 day ago
Is it really blackmail by a hacker?
So long story short, a few months ago I was contacted by someone who claimed to have taken over my phone and has access to everything. I thought I had that taken care of. In the last few days, this person resurfaced and is now attempting to blackmail me for $1500. They claim to be running something called a “gritx gap” that is paused on a timer. Should I be worried, or is it just a scam?
u/UnluckyChocolate5953 — 1 day ago
Grandmas Knickknack
Is this circuit too corroded or are the two cylindrical things batteries that need replaced. Apologies I’m uneducated on any circuits and electronics.
u/The_Abled — 1 day ago
FieldSurvey - OSS WiFi Survey Tool
We've developed an OSS WiFi survey tool with off-the-shelf hardware, including a couple of cheap USB dongles, a HackRF SDR, Raspberry Pi 4, and a small app that runs on your iPhone and communicates with the rPi over bluetooth. The iPhone app also streams live data into ServiceRadar (https://github.com/carverauto/serviceradar). We're working on a prototype custom PCB and looking for people that might be interested in helping with that, everything in this project is OSS, including any hardware we design. If you're interested in learning more drop me a line or join our Discord.
App will be available on TestFlight and we're writing a blog post that describes how to get this up and running and includes a BOM (bill of materials). Stay tuned.
u/ChaseApp501 — 2 days ago
GALAXY Z FLIP 6 broken inner display (probably dead touch too) [HELP]
My Galaxy Z Flip 6 is broken. Its inner display is totally black, probably due to leaking pixels. I am practically broke, so I can't get it repaired, but I want to use its Snapdragon 8 Gen 3 processor—no questions asked. By the way, I know the pattern lock, so I didn't steal it; it belonged to my grandfather, but he bought a new phone after its display died.
My available hardware:
Laptop: Low-end 4GB RAM HP laptop running Lubuntu
Secondary phone: Poco M3 Plus
Cables: 2 USB Type-A to Type-C cables
Budget: $0 (I cannot even buy a USB-A to Type-C adapter to connect a mouse)
What I have tried:
USB debugging is off, so scrcpy doesn't work.
Tried a direct cable connection, but Knox security blocks access.
The inner display touch is completely unresponsive.
The cover screen won't let me enter settings, has no apps, and doesn't seem to support Smart View or provide a way to do anything.
Pleaseeeessss tell me how I can tap into its processor and get it working. I don't care what you discuss(reverse engineering, bypassing knox or straight up hacking) just get it WORKING.
u/Apprehensive-Bar1262 — 1 day ago
Artics Pro Wireless Firmware Recovery Tool
I like many people within the sub Reddit have a set of Artics pro wireless headphones that have been bricked by the steel series firmware update utility frankly I cannot accept this for the price I paid for these and I am now actively researching into creating a firmware recovery tool it is very early stages, but I’m going to be using wire shark and p-cap to extract data from the steel series engine when it is attempting to do a firmware recovery so far I have only managed to get it to complete the recovery but the TX firmware still shows 0.00.00 and I’m unable to pair the headset. If there are any experts out there who would be able to collaborate with me and help me to try to achieve this, that would be great. I can share more about this if people are interested as it would be amazing to get these headphones working again. I am using AI and codex to achieve this and building on the work of others.
u/Macreflex — 3 days ago
Recovering a 2010 Macbook Pro and upcoming improvement, I'd like to find more powerful 1066 MHz 1rx8 ddr3 (if you have models in mind I take) and I plan to remove the player in it to put a 2.5" caddy sata adapter and change the hdd to an Sdd
u/Mediocre-Lead-8391 — 3 days ago
▲ 20 r/hardwarehacking
Root on an AM335x SoM without touching the eMMC - U-Boot bootdelay=0?
**The target**
- SoM: AM335x (BeagleBone-Black-class), Samsung 4GB eMMC, DDR3, TPS65217 PMIC
- OS: Arago 2016.02, Linux 4.9.28-rt, Dropbear on 22
- rootfs: /dev/mmcblk0p2 (ext4) on eMMC
- UART console (J6, 3.3V·GND·TX·RX) at 115200 8N1 reaches the login prompt
**Stuck**
- U-Boot has `bootdelay=0` and won't break to a prompt over serial — no `init=/bin/sh` / single-user route. Only the Linux login prompt, and I don't have the OS root password.
- **One unit, no spare** → eMMC glitch / chip-off / BGA rework are off the table.
Need something non-destructive.
**The ask**
Any trick to force a U-Boot prompt on AM335x when `bootdelay=0`, without hardware glitching? (corrupting the boot env, a pad to pull, etc.)
Is AM335x ROM serial/USB boot a realistic non-destructive way in — booting my own SPL over UART/USB without touching the eMMC?
u/tru0ne — 3 days ago
Open sourced bonsai-ninja: local code intelligence + security analysis built for humans and local first LLMs
Finally making bonsai-ninja public.
It’s a local code intelligence and static analysis engine built around compiler-backed facts instead of giant file dumps.
Use it for code intelligence, security taint analysis across 20 languages, or export call graphs, control flow, dataflow, IDG facts, and other structured compiler data for AI training, code-reasoning research, and agents.
It’s also built with local-first AI in mind. Pair it with your local LLMs to give them focused, compiler-backed context about a codebase instead of burning context windows repeatedly reading files. Models like Qwen and Nemotron are a great place to start, and experimenting with different local models is encouraged.
It’s free, MIT licensed, and runs locally. No subscription required, no hosted service required, and no analysis features held back behind a paid tier. Your source code stays on your machine.
Even if the engine isn’t your thing, the security-patterns alone are worth checking out. There’s an extensive YAML rulepack for modeling sources, sinks, sanitizers, frameworks, and security behavior across the supported languages.
This is just getting started. Contributions, testing, sharing, criticism, forks, whatever. Hell, steal it, improve it, build something better with it. Doesn’t matter. The goal is to put it out there and see what people do with it.
u/GromHacks — 3 days ago
▲ 703 r/hardwarehacking
Reverse-engineered an abandoned AVerMedia capture box, then gave an AI a telnet shell and let it write new firmware
I wanted to record the 640×480 HDMI output of an RP2350 board, and I had a mostly-dead AVerMedia Game Capture HD II in a drawer. The hardware still works, but the ecosystem around it had died. The YouTube API it streamed to, the mobile app, and I'd lost the IR remote - and on top of that it refused 640×480 as "unsupported." So I opened it up instead of buying something.
Inside it's a TI DM368 (DaVinci, ARM926 @ 432 MHz) with a hardware H.264 encoder, ITE IT6604E/IT6613E for HDMI in/out, a Nuvoton NUC100 as the system MCU, and 128 MB NAND.
Getting in was pretty standard: found the UART header with a multimeter, dropped to a root shell , and dd'd the NAND out from there (it wasn't as straightforward as it sounds here, but in the end, it worked out 🙂). Fortunately, I didn't have to do a physical memory dump, that would have been quite a challenge. The downloadable firmware is 3DES-encrypted, but the on-flash system is already decrypted so that didn't matter. The old DES root hash cracked in ~30 min and one U-Boot env var flips on telnet for persistent access.
Then the fun part: I gave Claude Code the telnet shell and watched it go. It explored the running box on its own - drivers, the video pipeline, the MCU's I2C protocol, the TI codec stack - and then, with a lot of steering from me, wrote a whole new firmware: a capture app, HTTP/RTSP servers, a web UI, and the build + flash tooling. The result does native H.264 (the box's hardware encoder) over RTSP into OBS/VLC, the resolutions the vendor had blocked purely in software (640x480 I needed and up to 1080p) and has pretty usable control panel.
AI was a huge accelerator but it needed constant babysitting. My favorite failure: a U-Boot prompt printing "Hit any key to stop autoboot" while actually waiting for one specific key. But the AI fixated on that printed label and even as I kept telling it to just read the disassembly it wouldn't. When it finally did: the bootloader hardcodes a compare against 'U' (cmp r3, #0x55). It also once "confirmed" a claim using terminal output it had invented itself, and wrote that into its own persistent memory as fact.
You can read the full write-up on my friend's blog: https://chiptron.eu/reviving-old-unsupported-devices-with-ai-avermedia-game-capture-hd-ii/
u/MakerClass — 5 days ago
Would this be possible on an M.2 NVME drive?
I have read that tools such as PC3000 and MRT Lab understand undocumented Vendor Specific Commands (VSC), and that these recovery tools can upload their own bootloader circumventing firmware signing in ROM/safe mode. Using similar techniques, would it be possible to modify an M.2 NVME drive for a similar covert storage system?
u/Acrobatic_Fan_25 — 4 days ago
Extreme PCI-e extention cable (looking for realistic limits for a story setting, not real build)
I'm writing a story featuring an implementation of a multiseat computer.
We are presuming the software is all good for the setting. This question is just about the hardware/firmware consequences.
Say you have a house with a terminal in each room. you wire a video cable, and a PCI-e x4 from a central computer, to each room. We're talking extension cables of several meters.
What are the upper limits for an PCI-e extension cable? And what technical problems could arrive from that. Would some sort of signal booster be needed at some point?
u/Kvagram — 3 days ago
▲ 64 r/hardwarehacking
How to extract firmware (if piece is even correct)?
Good day,
I am currently learning hardware security and extracted this daugtherboard from my smartlamp. I was wondering if the firmware is located on this board and would like to try and dump it. However I am a bit lost currently.
u/0xfee13bad — 5 days ago
▲ 27 r/hardwarehacking
found a cheap head unit at the thrift. i found an update file for it online and i've been trying to decode it so i can write my own.
i'm a noob, this is my first project. i did get UART working but all i got was the boot sequence. i wasn't able to do anything, that i could figure out, with the information i got. alternatively i did find an update file from an old car chat site, but its been hard decoding it. my hope is to write my own update file to... i don't know... rewrite the software? i'm not even sure how much i can unlock on this thing. it has an sd slot, bluetooth, and wifi. i'm hoping it could be a simple pda, but i have my doubts. any advice would be awesome.
u/Mean-Career-6509 — 5 days ago
A real prototype robot called 'Threehalves' made by Satyress Robotics for wildfire rescue and heavy labor. It is tele-operated by a human.
u/1KinFoe — 7 days ago
▲ 11 r/hardwarehacking
How do I take off this ribbon cable without breaking it?
u/c0de_is_good_fr — 5 days ago