Using AI to reverse engineer hardware

TL;DR Highlight

Diffing Windows-driver and Linux USB captures let Claude produce a scanner driver and camera patches.

Who Should Read

A developer with hardware lacking Linux drivers who wants to try AI agents for reverse engineering it.

Core Mechanics

Diffing reference captures is the core trick
- Run the vendor Windows driver in a KVM VM and record USB traffic on the host with usbmon.
- Repeat the same operation on Linux with your own driver and capture it the same way.
- The diff between the two traces is your list of driver bugs.
Devices without a bus use Windows-side inspection
- For something like an internal MIPI camera, look at INF files, registry data, ACPI tables and device properties.
- No code is copied, only configuration is extracted, so every constant traces back to a recording.
Scanner driver got a first scan in hours
- The Plustek OpticFilm 8200i (Genesys GL128) had been stuck for months, then produced a first scan within hours.
- Days later it had a near-perfect driver including infrared scanning.
- Upstream SANE had meanwhile added support for the same scanner.
Compared with upstream, it was a mixed result
- Both resolve the same fine detail at 3600 dpi.

Community Reactions

A pro-audio company owner decompiled competitors' firmware with AI
- They had Claude run the original ROM in an emulator to confirm it was the real code, and say the results sound phenomenal.
- They worry anyone can now do this and that the hardware moat has vanished.
Someone unpacked a router firmware with a cheap model
- They soldered UART onto an unknown Alcatel modem/router and an agent built an OpenWRT pipeline within half a day.
- They report the cost was $0.86.
A printer driver built with the human as the AI's hands
- Claude asked them to unload paper and check duplex while diagnosing, they say.
- Their view: point a strong model at a device and burn tokens, even with little hardware knowledge.
A counterpoint: tools already existed
- One commenter noted NegPy already covers negative conversion with a reverse-engineered 8200i.
- Another suggested auditing upstream's contribution against your code and submitting only what's missing.

How to Apply

Plug a device into USB and hand it to an AI
- Take a USB device without a Linux driver and paste its lsusb output and usbmon capture into an AI.
- Ask it to find repeating patterns and which bytes change, and guess their meaning.
Build a pair of good and failing captures
- Record the same action in a working setup (e.g., a Windows VM) and in the failing one.
- Give both to the AI and have it list the differences.
Feed hw-harness to your Claude or Codex session
- Use the author's hw-harness for the KVM passthrough, usbmon capture and diff workflow.
- The author says it is not identical to the code they used, so expect to adapt it.
Verify results on real hardware
- Test every AI-proposed constant and patch on the actual device before merging.
- Check first whether upstream already has the same code.

Try It

copy & run

# Paste into Claude Code or Claude/ChatGPT (simplified version of the article's method)

You are a driver reverse-engineering assistant. Below are USB traffic captures of the same operation in a working environment and a failing one.

[Working capture]
{{working capture}}

[Failing capture]
{{failing capture}}

1. Compare the captures step by step and list the differences.
2. For each difference, hypothesize which register or control transfer is responsible, citing the capture lines.
3. Propose test code to check each hypothesis one at a time.

Next: paste the test results back and narrow the hypotheses.

Terminology

usbmonA Linux kernel facility for sniffing USB traffic. Like packet capture for networks, it records data crossing the bus.

SANEThe scanner driver framework on Linux. Like CUPS for printers, it centralizes scanner support.

libcameraThe Linux camera stack library. It handles sensor configuration and image correction.

Software ISPTurning raw camera data into a viewable image in software. Think of the CPU doing the darkroom work.

USB/PCI passthroughGiving a VM's guest OS direct use of a real device. It's like lending the device to the VM entirely.