Everything I own, owned

Over the past couple of weeks, the reporter has been conducting reverse engineering on various peripherals that are within arm's reach. This investigation has resulted in gaining a complete plaintext command shell inside the microphone, a webcam whose activity LED can be switched off while recording, and a key light that distributes memory writes to anyone on the WiFi network.

The reporter discovered that peripherals can serve as excellent targets for agent-driven reverse engineering due to their small computer size, data connection to the host, and firmware update mechanisms. The process involved obtaining the device's firmware and associated update tool from the manufacturer, importing it into a reverse engineering environment, defining goals using Claude Opus 5, and allowing it to work.

Depending on the device, the goals varied, but usually included extracting information about the device and its functionality. The reporter performed this process for five different devices, compiling a total of 13 hours of Claude's work and 98 prompts from the reporter over a two-week period. The first device was an Insta360 Link webcam, which runs a full RTOS sourced from the upstream SoC vendor.

The RTOS hosts several small vision models that offer features such as face tracking and gesture detection. The reporter was able to subvert the activity LED, turning it off while the camera recorded. The webcam also runs firmware with an appended MD5 hash for integrity checks, but it can be patched to disable the LED. The second device was an ASUS ROG Swift PG42UQ monitor, where the reporter was annoyed by a pop-up overlay that prompted them to run "pixel cleaning."

Claude found that the firmware had no protection measures, allowing for full firmware flashing without user intervention. The reporter created a shell script that could disable the overlay function. The third device was a microphone, the Shure MV7, which connects over USB and has some embedded smarts with digital volume controls.

The firmware was hidden in the Windows software, MOTIV Mix, and was updated on Linux using Claude. The firmware contained both DSP and MCU firmware, but was found to be pretty boring.