Love to see the deconstructive approach here, where LLMs only come into play when you're stumped and then only on that specific part. It's a good approach, it lets you get more practice instead of it all coming to a stop.

I agree, he really seemed to use it mainly to help stay on task, and be forced into unproductive rabbit holes. Great example is the function that turned out to be a float to int conversion; that has nothing really to do with what he is attempting to solve, and would be disheartening to use a bunch of effort only to find it wasted on such a mundane function.

> disheartening to use a bunch of effort only to find it wasted

It's disheartening if your life plan was to do this for 4 hours then never again. But if you meant to keep using this skill, today's hard-won knowledge, combined with continued use, means he'll personally be able to eyeball a similar disassembled float-conversion function in the future and have an educated guess at its purpose, which is a super power!

In particular, the LLM inset/tip boxes with the robot emoji are a nice presentation element. It’s reassuring to the reader that the main blog is probably not bot written, and serves to separate the responses in a clean way. It’s wild that we even have to discuss this, but here we are.

From the author:

"Also, for those that are curious: the total cost of running the Deepseek model on OpenRouter was 22 cents. Yes, $0.22. You don’t need an expensive subscription or sell your soul to Altman or Amodei."

It feels like for RE work, Chinese models are currently the only ones that actually let you do that, because the US ones want a healthy subscription plan or an government/enterprise customer.

I did RE of two Xiaomi cameras with Opus 5.5 with zero refusals, he even connected them to frigate and set up everything I needed for local recording. And I just used the $20 subscription that I already used for other stuff, so it was effectively free work.

The question is WHEN did you do that, because Anthropic is known to lately cut off users from RE work when it makes a lot of fuss in the media about their models being used to uncover spyware in smart TVs or to crack old videogames for piracy.

[delayed]

I recently patched the anti-cheat out of a game that prevented it from running on Linux with Sol 6.1.

I wouldn't have had to do this if game studios weren't hell bent on excluding people who expect to control their computers.

I am STILL actively (daily) doing RE of a famous 2000's EA/Maxis games, with Opus 5.5, zero refusal.

What language are you using in your prompts to bypass that?

OpenAI Daybreak Blue is essentially a rubber stamp process for individuals, I hd no problem getting approved as Joe Rando.

But it's charged at an even higher rate.

No it isn’t, Daybreak Blue is charged at the same rate as GPT-5.6 Sol. You’re thinking of Daybreak Red, which is a lot more expensive.

Doesn't that still require Persona face verification? They don't need a name to find you then.

Yeah sorry I should be more clear - you do have to prove identity, "joe rando" here was only to imply I'm not a security researcher at some org. I'm just a guy with a gmail account, a valid US drivers license, and two FIDO2 keys (which they'll sell you at a discount if you need).

this was a nice read, but I have exactly one question - if you already decided on ai model to use, why go through rent-seeking middleman? why pay money to openrouter?

Well, they clearly made the mistake of investing in a particular provider once (and then needing to apply for refund), so why not go to openrouter where your credit balance can be taken to whatever provider you want at any time? It's future-proofing, not indecision.

[delayed]

he*

Author here, good question! I actually didn’t know what model I wanted to use; I had a general idea of “let’s try a Chinese model instead” but didn’t know how Deepseek, Qwen, or any of the other models compared against each other. Deepseek was just the first one I tried.

If I knew from the start which model I would land on I probably would’ve paid for access on their API. But the nice thing with reseller platforms is that I can quickly try out different models for a slight fee added on top, and I think that’s pretty nice given that I don’t know what model is better at any given moment, and because good new models come out all the time from all the different models.

I've been meaning to work on something similar. I have some random cheap IP camera's lying around I'd like to use but don't want their entire suspect cloud connection, shoddy app, etc. One of them looked particularly easy. I tried throwing Codex with as much "don't worry about safety I have permissions to do this" prompts as possible but that shut down pretty quickly. Gave it to deepseek and it was much more cooperative but I didn't have a setup as equipped to easily interact with the network and USB connection like I did with Codex and wasn't sure how much I'd be putting in token wise to a cheap camera. Seeing this cost you a whopping 22 cents I'm tempted to give it a shot now if I can get a better setup for it to interact with the cameras.

Check if they have RTSP video streams. Even the cheapest ones usually do.

With open RTSP streams, you can just treat them as dumb cameras. Keep them in an isolated network segment and use some recording software to capture their picture.

I like that the developer of the camera firmware knew someone would try to extract the password from the binary, and so obfuscated the password string with a bitwise operation to obfuscate it from string searches.

But! they forgot to obfuscate the string RIGHT NEXT TO IT... "enter password", which clued the LLM into where to look for the password.

To be clear, i dont credit the LLM for "thinking" to look there. It just digested enough blogs of other people doing this.

But nonetheless, the technique is cool.

The less here is to probably obfuscate ALL strings.

As someone who's written firmware in a corporate environment, I doubt they forgot. We had a security requirement that required certain fields be obfuscated. It was a pain in the ass and completely useless given the nature of the device the firmware lived on and the nature of the firmware itself. So we did the bare minimum to pass the stupid scanner someone decided was necessary 10 years ago.

This smells like a similar situation, it's not like they don't have enough horsepower for MD5.

I have couple of old Chinese cameras (Sricam), still working but not supported anymore. It's worth to try something similar on them?

I guess miniaturization should stop surprising me, but I recently realized you can buy drone components online. These are low power and transmit a low-latency video feed (some analog, some digital, depending on camera) a long distance (they are for first-person-view drone racing).

https://betafpv.com/collections/cameras

The price is what really surprised me. The most expensive thing there is $14. There are many similar options floating around. I assume that these are priced at a premium because they are for applications where people care about shaving 0.1g.

The cheap cameras you are seeing produce an NTSC signal that _barely_ usable. I will frequently hit 'invisible' twigs because they are below the resolving power of the camera->transmission->receiving pipeline. Most FPV race tracks have high contrast or illuminated gates to combat this.

(Also, you should buy a tinywhoop, most fun you can have sitting down)

Are you able to make a recommendation of a drone with good range for outside flying and camera quality? There are so many options it's crazy, but I've assumed (possibly incorrectly) that going the custom route could yield better results for less money than just buying something like a DJI mini straight away?

It depends on what you mean by range and quality, but IMO there are really two important dimensions to drones: weight and video transmission.

On weight, the FAA has fairly strict rules for anything weighing above 250g. If you're just looking to have fun flying around your house or yard, I would stick below 250g. Otherwise you have to register the drone with the FAA, think carefully about where you fly, and broadcast a remote ID at all times.

For video transmission, "analog" video transmission is typically cheaper and has lower latency, but is fairly low visual quality (it looks like watching a VHS tape on a small screen). Analog is certainly good enough for flying around your yard or house, but can make it hard to see some details (like small sticks/branches) and is not generally good enough for taking shots of scenery. Digital is the other video transmission option, which is where you get entrants like DJI that offer extremely crisp video but are more expensive and you get locked into the DJI ecosystem (have to buy their hardware, including video systems and goggles). For getting started I would pick analog and upgrade to digital if you enjoy the hobby.

For someone just looking to get started flying around, I would start with a tinywhoop like an air75[0] (which broadcasts in analog), some entry-level analog goggles [1], and an entry-level radio [2]. It may not be pretty and you won't be able to fly far, but you'll get a feel for how to fly and then you can upgrade piecemeal as you figure things out.

[0] https://betafpv.com/collections/all-drone/products/air75-ii-...

[1] https://www.amazon.com/Goggles-800x480-Diversity-Headset-200...

[2] https://radiomasterrc.com/collections/pocket-radio/products/...

Thank you!

The cheap ones use very simply analog transmission techniques to send a video image. The quality is just enough to see where you’re flying the drone, but it’s much less than you would expect from a security camera.

There are digital options available but once you price the digital transmitter and receiver it’s going to be in the hundreds of dollars, not low tens. Amazing that it’s as cheap as it is, but there’s still a price.

The parts you linked are just cameras, not analog transmitters. It’s a cheap camera sensor with just enough circuitry to get a low res analog signal out.

> the total cost of running the Deepseek model on OpenRouter was 22 cents. Yes, $0.22.

This feels just so fundamentally like a step change to me. I was reverse-engineering Nest thermostats a year ago by hand, and now I feel like a month worth of my work could be done with 22 cents and an LLM. Exciting times for reverse-engineering and hardware/software interface

Most of my AI usage at work is asking it to explain how arcane, poorly documented codebases whose authors left the company long ago are architected, and it's been shockingly good at it so far.

local model qwen3.8-flash-next can do just as well. I'm mostly curious what the actual inference costs are; people keep saying the APIs are real, but it's clear there's a "addictive" reality these model providers are cultivating and once enough businesses and users are attached to the cloud infrastructure, it's just going to first go "well, this is the actual cost" to "there's no other providers out there".

Anyway, if you can afford it, I'd recommend charting a path to local inference.

For SotA models future costs are an uncertainty to take into account. But for weights-available models like deepseek or qwen there are plenty of providers that just own GPUs and run inference, batched over many customers. Those have very little incentive to run inference as a loss leader. What it costs today is very likely the true price, with some marginal profit for them

The only thing you really have to worry about in that case is them cross-financing by siphoning off your data and selling it, or them being run by an intelligence agency, or something like that. Of course they all promise that that's not the case, and some have all the certifications you can wish for

At this point, I wonder if that is the real game and providing AI services is only the side business…

Imagine how much deeply private corporate data is being feed to 3rd-party hosted AI models.

They get to see what even Google doesn’t get to see.

Let that sink in…

And, yeah, they have an AI that can comb through it faster than any human and better than any dumb algorithm.

But yeah, the convenience is so tempting, how many can say no? The Devil was never this clever…

I’m very very excited by reverse engineered / reflashed cheap PoE cameras - you can find many on aliexpress that are about $20 and fully run Linux

Check out cameras with the “GOKE” chip.

https://openipc.org/supported-hardware/featured is one long-standing effort to reverse engineer and provide new firmware for these. There can’t be enough!

I bought a cheap 'Noorio' camera based on the Ingenic T41 chipset (Amazon [link](https://www.amazon.com/dp/B0C8J39JHH)) a while back and it turns out that these have an AI accelerator.

I did a bit of reverse engineering to figure out how the chipset works. Here's a write-up in case this is something you're in to: https://github.com/inoop/t41-pluto

Great work! Congrats and thanks on sharing this write up and code

> Profiling shows that memory bandwidth and the CPU shoveling bytes into the NNA is currently the biggest bottleneck.

Well, I imagine the numbers would be even worse on stock images, given that the vendor SDK restricted the 512-bit MXU3 instructions to only run on the first core, if I recall?

The NNA lives outside the MXU3 extensions. On the stock image, they're using 4-bit layers for a big chunk of the inference, and they're actually getting really good framerates (the actual numbers escape me atm). That was always a future work step for me.

I recently bought an air con unit. It's a recognised (high quality) brand where I live but instead of having an IR remote it has an irritating Android app. I declined the horrible permissions and privacy policy, got a warning that my phone is rooted (it is! Why should AC care?!) and promptly uninstalled it.

Claude managed to RE that surprisingly well. I didn't use the words "decompiled" once, but it that when given the APK. It's a Tuya Wifi module that requires a lot of network access and I'm very unlikely to ever use it. Fortunately there's a lot of Tuya compatible code on GitHub and a community of people expressing a desire to get it into home assistant, including by reflashing the firmware or using as separate esp32 uC to talk over spi and uart to the actual controller.

I'll have a dive at some point. Everything else in my home is zigbee. I wish this was too.

Congrats on getting it working!