I needed to capture a 640×480 video stream from a Raspberry Pi Pico 2. I had a rather dusty AVerMedia Game Capture HD II at home - the hardware still works, but everything around it had died: the YouTube upload API it streamed to, the mobile app that controlled it, and I'd lost the IR remote. On top of that, it rejected 640×480 as an "unsupported resolution." A somewhat functional recording device with no usable way to manage it.
I started with the standard reverse-engineering process: found the UART, got a root shell, and dumped the flash. AVerMedia's downloadable firmware is 3DES-encrypted, but the key is hardcoded in their own binary; the root DES hash cracked in about 30 minutes, and a single U-Boot environment variable enables telnet for persistent access.
Then came custom firmware, written almost entirely by AI (recording app, HTTP/RTSP servers, web UI, build + flashing). It now does native H.264 over RTSP to OBS/VLC, records at resolutions the manufacturer blocked purely in software (640×480 up to 1080p) and has a small web UI - making it more capable than the original firmware.
The post is also about where the AI failed, which I find the more interesting part. For example:
Once it "proved" a claim using the output of a command it had invented itself, then stored that assumption in its permanent memory as a fact.
For thousands of lines it insisted the U-Boot interrupt key was "any key" (as the prompt prints) - but the binary hardcodes a comparison against the letter 'U', which is exactly what I'd asked it to check from the start.
It was genuinely fun, and now I have a fully functional device that would otherwise have ended up in the trash.
I needed to capture a 640×480 video stream from a Raspberry Pi Pico 2. I had a rather dusty AVerMedia Game Capture HD II at home - the hardware still works, but everything around it had died: the YouTube upload API it streamed to, the mobile app that controlled it, and I'd lost the IR remote. On top of that, it rejected 640×480 as an "unsupported resolution." A somewhat functional recording device with no usable way to manage it.
I started with the standard reverse-engineering process: found the UART, got a root shell, and dumped the flash. AVerMedia's downloadable firmware is 3DES-encrypted, but the key is hardcoded in their own binary; the root DES hash cracked in about 30 minutes, and a single U-Boot environment variable enables telnet for persistent access.
Then came custom firmware, written almost entirely by AI (recording app, HTTP/RTSP servers, web UI, build + flashing). It now does native H.264 over RTSP to OBS/VLC, records at resolutions the manufacturer blocked purely in software (640×480 up to 1080p) and has a small web UI - making it more capable than the original firmware.
The post is also about where the AI failed, which I find the more interesting part. For example:
Once it "proved" a claim using the output of a command it had invented itself, then stored that assumption in its permanent memory as a fact.
For thousands of lines it insisted the U-Boot interrupt key was "any key" (as the prompt prints) - but the binary hardcodes a comparison against the letter 'U', which is exactly what I'd asked it to check from the start.
It was genuinely fun, and now I have a fully functional device that would otherwise have ended up in the trash.