thehardwarestore.ai

Bloopair is a Wii U homebrew project that enables the use of third-party Bluetooth controllers (Nintendo Switch Pro/Joy-Con, Xbox One, DualShock 3/4, DualSense) on the console. It achieves this by patching the Wii U's IOS (the ARM-based operating system that handles Bluetooth) at runtime via a kernel exploit. The project consists of four main components: a loader that triggers the exploit and installs custom ARM code into IOS; an IOS kernel module that patches kernel error handlers and maps memory; an IOS pad module that intercepts Bluetooth HID reports, converts them to the Wii U Pro Controller format, and manages controller pairing and configuration; and a companion GUI application (Koopair) that allows users to test controllers, remap buttons and sticks, and manage per-controller settings. The system communicates between the PowerPC (PPC) application and the patched IOS via a custom IPC library (libbloopair). The architecture is modular: the loader is a one-shot exploit, the IOS modules are injected binary blobs, and the Koopair app is a standard SDL2-based homebrew application. The controller drivers are implemented as a set of function pointers (init, data, rumble, etc.) per controller type, providing a clean abstraction. The configuration system uses a linked list of entries with fallback logic, supporting per-controller-type and per-BDA settings. The project demonstrates significant reverse engineering of the Wii U's Bluetooth stack, including Wiimote cryptography, SDP, and HID report parsing. It is actively maintained with recent commits and CI builds, though it relies on hardcoded memory addresses specific to certain firmware versions, making it fragile but stable on the frozen Wii U platform.

This repository is a specialized tool for automated C code permutation to match a target compiled binary, primarily used in video game decompilation projects (e.g., Nintendo 64). The core loop reads a C source file and a target object file, then repeatedly mutates the C code using a set of predefined random transformations, compiles it, disassembles the output, and scores the resulting assembly against the target. The goal is to produce a C source that compiles to identical or nearly identical assembly, reducing manual effort in reverse engineering. The architecture is a Python CLI application with support for multi-threading and distributed computing. The main entry points are `permuter.py` (local mode), `import.py` (project setup), and `pah.py` (network client for distributed 'permuter@home'). The system relies on a vendored fork of pycparser for C parsing and AST manipulation, and it integrates with external tools: a C compiler (GCC, IDO, or MWCC), `objdump` for disassembly, and optionally Docker for sandboxed remote evaluation. A Rust server (`src/net/controller`) manages the distributed network, and a Go systray helper provides a system tray icon for the network client. Data flows are iterative: the tool seeds a candidate, applies one or more random permutations (e.g., introducing temporaries, reordering declarations, transforming expressions), compiles the result, extracts assembly, scores it using a diff-based algorithm, and keeps the best candidate. The process repeats until a perfect match is found or the user stops it. The project demonstrates high craftsmanship in its modular design, with clean abstractions for permutations, scoring, AST utilities, and networking. The vendored pycparser is heavily patched for GNU C extensions, and the custom stubs ensure type safety.

FISSURE is a modular RF signal-intelligence and reverse-engineering framework. In production it provides a PyQt5 dashboard for spectrum survey, IQ capture/playback, burst conditioning, signal classification, protocol discovery, targeted transmission, and fuzzing across SDR hardware such as USRP, HackRF, LimeSDR, RTL-SDR, PlutoSDR, and bladeRF. It coordinates distributed sensor nodes through a HIPRFISR hub over ZMQ, integrates with TAK via Cursor-on-Target messaging, and supports plugin-based automation operations. The repository also contains a very large GNU Radio flow graph library (maintained for GR 3.8 and 3.10), custom OOT blocks for ADS-B, Bluetooth, ACARS, X10, Z-Wave, fuzzing, and wideband detection, plus packet-crafting and replay tooling for security research.

teddyCloud is a self-hosted, open-source replacement server for the Toniebox children's audio player. It implements the entire cloud-side protocol stack—including HTTPS, TLS, MQTT, and custom protobuf-based APIs—to intercept, proxy, cache, and serve audio content to physical Toniebox devices. The application is written in C, builds on the CycloneTCP networking library, and integrates a full MQTT server, a Home Assistant bridge, a web administration interface, and tools for firmware patching (ESP32, CC3200, CC3235) and certificate generation. It also includes a WebAssembly-based TAF audio encoder for browser-side use. The codebase is a result of extensive reverse engineering of the Toniebox protocol, demonstrating deep expertise in embedded systems, cryptography, and IoT networking. While tightly coupled to the Toniebox ecosystem, several components (MQTT server, settings overlay system, WASM encoder) are designed with sufficient abstraction to be reusable in other contexts.

LLEf (LLDB Enhanced) is a Python-based LLDB plugin for low-level reverse engineering, vulnerability research, and exploit development. It provides enhanced debugger context (registers, stack, code, threads, trace) via an automatic stop hook and adds specialized commands: context, hexdump, pattern (cyclic pattern generation/search), checksec (ELF security mitigations), xinfo (memory mappings), dereference (pointer chain dereferencing), and scan (heap/memory scanning). It supports multiple architectures (x86_64, ARM, AArch64, i386, PowerPC) and includes experimental Go binary analysis: parsing the PCLNTAB and ModuleData structures to recover function names, types, and stack frames from stripped Go executables (versions 1.7–1.24). The plugin persists configuration via JSON files in the user's home directory. The codebase is structured with clear base classes for commands, settings, and architecture definitions, though it lacks automated tests and relies heavily on the LLDB Python API.

Xenia is a research-grade emulator for the Xbox 360, written in C++ with a focus on accuracy and performance. It translates PowerPC (PPC) guest code into x64 machine code via a custom JIT compiler (HIR → x64 backend) and emulates the Xenos GPU using D3D12 and Vulkan backends, including shader translation from Xbox ucode to HLSL/SPIR-V. The system also emulates kernel subsystems (XAM, Xboxkrnl), audio (XMA decoding via XAudio2/SDL), input (XInput, keyboard, SDL), and the virtual file system (STFS containers, disc images, host paths). The architecture is modular with clear subsystem boundaries (base, cpu, gpu, apu, hid, kernel, vfs, ui), each with platform-specific implementations for Windows, Linux, and Android. Key entry points include the main emulator window (xenia_main.cc), the CPU processor (processor.h), the GPU graphics system (graphics_system.h), and the kernel state manager (kernel_state.h). The emulator is primarily a desktop application but includes Android support and several standalone tools for shader compilation, GPU trace analysis, and API scanning.

VxKex is a Windows compatibility layer that enables applications designed for Windows 8, 8.1, and 10 to run on Windows 7 SP1. It achieves this by injecting a core DLL (KexDll) into target processes via Image File Execution Options (IFEO), rewriting import tables to redirect API calls to extended DLLs (KxBase, KxUser, KxCom, KxDx, etc.) that implement missing or modified functions. The project also includes a kernel-mode driver (KexKMSD), a configuration GUI (KexCfg), an installer (KexSetup), a shell extension (KexShlEx), a log viewer (VxlView), and a launcher (VxKexLdr). The codebase is deeply tied to Windows 7 internals, using undocumented NT APIs, assembly syscall hooks, and version spoofing. It is a monolithic collection of tightly coupled C projects built with the Windows 7.1 SDK and custom build utilities. While functionally impressive and demonstrating deep reverse-engineering skill, the code is informal, contains many stubs and TODO comments, and has limited reusability outside its specific context.

TSforge is a CLI utility that directly manipulates the Windows Software Protection Platform (SPP) physical store to achieve permanent activation or extended evaluation periods for Windows Vista through 11 and associated add-ons (e.g., ESU). The codebase is a well-structured C# application targeting .NET Framework 3.5, consisting of a library (LibTSforge) and a command-line entry point (TSforgeCLI). It implements multiple activation methods (KMS4k, AVMA4k, ZeroCID) and modifiers for resetting grace periods, clearing tamper flags, and installing generated product keys. The architecture involves decrypting the encrypted physical store file, parsing its block-based structure, inserting new activation data (timers, bindings, HWID blocks), re-encrypting, and writing back while managing the SPP service. The code demonstrates deep reverse engineering of Windows licensing internals, with careful handling of different store formats across OS versions. Despite targeting a deprecated .NET version and using legacy cryptographic primitives (SHA1, RSA PKCS#1 v1.5), the code remains functional for its niche purpose.

This repository implements a full-stack content operations platform exclusively for Xiaohongshu (XHS), the Chinese social media platform. It provides a complete lifecycle for managing XHS notes: discovering content via search or URL crawling, saving to a local library, AI-assisted rewriting and title/tag generation, scheduling and publishing through XHS's Creator API, and monitoring engagement metrics. The system is built as a modern web application with a FastAPI backend (Python) and a React frontend (TypeScript, Ant Design), using SQLAlchemy for persistence and APScheduler for background job execution. The architecture is a monolith with clear separation of concerns: backend API routers for accounts, notes, drafts, AI, tasks, publishing, monitoring, and analytics; a service layer for business logic; and a set of adapters that encapsulate the reverse-engineered XHS API clients. The frontend provides a dashboard, discovery page, content library, draft editor, publish center, auto-ops scheduler, and analytics views. Authentication uses JWT tokens with refresh logic, and the system supports multiple XHS account types (PC web and Creator) via QR code or phone login. A notable aspect is the extensive reverse-engineering of XHS's anti-bot mechanisms. The codebase includes custom JavaScript modules for generating signatures (b1, MNS, X-S, X-T, websectiga, profileData) and browser fingerprint emulation, all executed locally via Node.js subprocesses. This allows the platform to interact with XHS APIs without a real browser, enabling automated content operations at scale. While the primary focus is on XHS, the platform abstraction layer (PlatformId enum, adapter interfaces) suggests an intention to support other social media platforms, though only XHS is currently implemented. The repository is a hybrid of application and data engineering: it is primarily a production-grade web application with scheduled tasks, user management, and a rich UI, but it also contains data pipeline elements such as crawling, normalization, and storage of XHS content for later analysis. The data models and analytics endpoints provide research-like capabilities (keyword tracking, engagement trends, benchmarks), but these are embedded within the application rather than forming a standalone data research project.

TitanEngine is a Windows-native C/C++ library for reverse engineering, debugging, and unpacking PE executables. It provides a large exported C API covering process debugging (create/attach/detach, breakpoints, stepping), memory and register manipulation, PE file parsing and modification (sections, imports, exports, relocations, TLS), hooking (code redirection, IAT patching), import reconstruction (IAT scanning, dump fixing via integrated Scylla wrapper), anti-debugging evasion, and static file analysis (hashes, decompression). The codebase is primarily a monolithic DLL with hundreds of functions, tightly coupled to the Windows NT API and undocumented structures. It is the core engine behind the x64dbg debugger's unpacking and import-repair capabilities. While the library is functionally complete and has been battle-tested, it exhibits significant technical debt: heavy use of global mutable state, non-reentrant functions, manual memory management, hardcoded OS-specific offsets, and monolithic functions (e.g., DebugLoop). Some subsystems—such as the breakpoint handler, memory I/O with breakpoint bypass, file mapping utilities, and the self-contained ntdll.h header—demonstrate high craftsmanship and are reusable in other projects. The integration of scylla_wrapper and distorm adds well-engineered components for import scanning and disassembly, but overall the codebase requires careful use due to thread-safety and maintenance concerns.

This repository is a work-in-progress decompilation of The Legend of Zelda: Twilight Princess for GameCube and Wii. It reconstructs the original game's source code from its compiled binary, aiming for byte-perfect reproducibility. The codebase is a hybrid of reversed-engineered game logic, reimplemented Nintendo SDK libraries (JSystem, Dolphin, Revolution), and a massive collection of asset resource headers that define model, animation, and collision IDs for every in-game object. The architecture follows the original game's custom actor framework (f_op/f_pc) combined with middleware from JSystem and the Nintendo SDK. The project supports multiple region and platform variants (GameCube, Wii, Nvidia Shield), with resource headers duplicated across version-specific directories. The decompilation is incomplete; many source files are stubs or placeholders (marked NONMATCHING), and the asset headers are auto-generated or manually copied from the original game's data. The code is written in C++ with Metrowerks compiler conventions, and the build system uses Python and Ninja. While not a runnable application on its own (requires a copy of the game), it represents a comprehensive reverse-engineering effort with active development and community engagement.

This repository is a community firmware modification and reverse-engineering toolkit for Realtek RTL960x-based GPON/EPON SFP ONT modules. In practice, it is not a single application but a collection of vendor firmware images, patched root filesystem overlays, embedded WebGUI replacements, shell scripts, QEMU emulation helpers, and extensive OMCI/flash-parameter documentation. Users deploy the modified firmware and scripts onto SFP sticks to replace ISP-provided ONTs, clone ONU identities, enable 2.5GbE link modes, fix VLAN behavior, and expose device telemetry through Prometheus. The architecture is best described as a loose ecosystem of independent tools centered around the ONT's `flash get/set` and OMCI CLI interfaces, with no unified build system or runtime. The most maintainable software artifacts are intentionally self-contained: a Prometheus exporter in `WebGui/kitamon/` scrapes the ONU web GUI and publishes metrics; an emulator wrapper in `Tools/emulator/` extracts and repacks firmware images for safe testing outside hardware; and a reset script in `Tools/reset/` automates factory recovery over SSH. The rest of the repository is largely raw binary firmware dumps, modified `boa` web pages, and dated vendor SDK outputs. It serves a niche but active hobbyist/ISP audience, and while there is no CI or automated testing, the documentation breadth and practical utility are high. The main risks are legal sensitivity around ISP firmware dumps, dependence on old vendor toolchains, and potential bricking during manual flashing.

Wirebrowser is an Electron desktop application that provides an integrated runtime instrumentation platform for web applications, built entirely on the Chrome DevTools Protocol (CDP). In production, it acts as a unified debugger, memory inspector, network interceptor, and automation runner for JavaScript running in Chromium-based browsers. The application launches a headless or headful Chrome instance via Puppeteer-core, attaches CDP debuggers to multiple pages, and presents a rich GUI (React, Ant Design, Monaco Editor, AG Grid) through an Electron window. The architecture follows a modular event-driven design: core back-end modules (Heap, Debugger, Network, Automation) are loaded by a ModuleManager and communicate with the front-end via custom DOM events and Electron IPC. The debugger module implements a sophisticated hook system that injects user-defined JavaScript callbacks on function entry/leave/return without monkeypatching, using CDP breakpoints and a state machine to serialize asynchronous events. The heap module supports both live object search (via injected QueryObjects) and offline snapshot analysis with object similarity matching (Jaccard/Dice/SimHash) for origin tracing. Key data flows include user-defined automation scripts (Node-side or browser-side) that interact with pages through the WB.Node and WB.Browser APIs, network requests that can be intercepted and modified in real-time, and memory snapshots that are queried for structural matches across multiple snapshots (BDHS). External dependencies are heavy: Puppeteer (bundled Chrome), AG-Grid (community), Monaco Editor, Ant Design, lowdb, and several CDP-specific features that lock the tool to Chromium. The project is primarily targeted at security researchers, reverse engineers, and advanced frontend developers who need introspection beyond standard DevTools.

This repository implements the Elden Ring Practice Tool, a Windows application that provides an in-game overlay with cheats, debugging utilities, and speedrun practice features for Elden Ring. The system works by injecting a DLL into the game process, hooking DirectX 12 to render an ImGui overlay, and reading/writing game memory via pointer chains. The architecture is a Cargo workspace with multiple crates: `practice-tool` (main DLL with overlay UI), `lib/libeldenring` (core memory editing and parameter access library), `lib/param-tinkerer` (standalone parameter editor), `lib/no-logo` (intro screen removal DLL), `lib/scripts` (injector), and `xtask` (build and code generation orchestration). Key entry points include `practice-tool/src/lib.rs` (DLL main), `practice-tool/src/practice_tool.rs` (ImGui render loop), and `xtask/src/main.rs` (build tasks). Data flows involve reading game memory via pointer chains, parsing game parameters from community-maintained Paramdex XML, and generating Rust structs and base addresses via AOB scanning. External dependencies include `hudhook` for injection, `imgui` for UI, `windows` crate for Win32 APIs, and `Paramdex` for game data definitions. The tool is heavily version-dependent, supporting 28 game versions with hardcoded base addresses.

This repository provides an ARM64 tracing and emulation workflow based on the Unicorn engine, designed to work as an IDA Pro plugin and with standalone replay capabilities. The system allows users to trace ARM64 code execution within IDA, dump memory segments, generate Tenet-compatible logs for analysis, and replay traces offline. Key features include dynamic code simulation, memory dumping, register state tracking, instruction-level logging, and special handling for ARM64-specific instructions like MRS TPIDR_EL0 and AUTIASP. The architecture separates IDA integration (dyn_trace_ida.py) from core emulation logic (unicorn_trace/unicorn_class.py), enabling both interactive tracing within IDA and offline replay of captured traces.

Il2CppMemoryDumper is a shell script designed to extract Il2Cpp metadata and native libraries from the memory of a running Android process. It operates by scanning the target process's memory maps for regions associated with libil2cpp.so, global-metadata.dat, and split-config APKs, then dumps these regions to files after verifying their content via magic number checks. The script includes logic to merge adjacent memory regions for ELF files and handle anonymous .bss sections, outputting files with naming conventions based on memory offsets. It is intended for use in a rooted Android shell environment and relies solely on standard Linux utilities (awk, bc, dd, grep, etc.) without external dependencies.

This repository provides a collection of scripts, tools, and binary patch files to remove the simultaneous NVENC encoding session limit and enable NvFBC (NVIDIA Frame Buffer Capture) on consumer-grade NVIDIA GPUs. The core mechanism is binary patching of NVIDIA driver shared objects (Linux) and DLLs (Windows) using version-specific byte replacement strings. On Linux, the main entry points are patch.sh and patch-fbc.sh, which use sed to apply patches to libnvidia-encode.so and libnvidia-fbc.so. The project also includes a Dockerfile and docker-entrypoint.sh for applying patches inside containers without modifying the host, and supports Flatpak installations. On Windows, patches are distributed as .1337 files (a simple text-based patch format) and applied using a third-party tool (Win_1337_Apply_Patch). Additionally, a wrapper DLL (nvfbcwrp) intercepts NvFBC API calls to inject the required private keys, enabling NvFBC on consumer cards. The repository also includes a suite of supporting tools: an automated driver locator (nv-driver-locator) that scrapes NVIDIA websites for new releases, an autopatch system for generating patches from driver installers, a patch tester that verifies the patch by running multiple concurrent NVENC sessions, and a README autogenerator that keeps documentation synchronized with the driver database (drivers.json). The architecture is a hybrid of shell scripts, Python tools, and a small amount of C++/assembly for the Windows wrapper. The project relies on external dependencies such as sed, 7zip, ffmpeg, and the Win_1337_Apply_Patch submodule. The codebase is heavily oriented towards reverse engineering and binary manipulation, with a manually curated database of driver versions and patch offsets.

This repository is a distribution bundle of third-party reverse engineering and malware analysis tools for Windows, packaged with an installer and updater. The tools are organized into categories such as Analysis, Decompilers, Disassemblers, Hex Editors, Network Monitors, Unpackers, and more. The project provides Inno Setup scripts for building installers, a custom updater executable, and CI/CD workflows (GitHub Actions) for automated builds and signing. The custom code (Python scripts for installer generation, batch files for tool updates) is functional but tightly coupled to this specific packaging project. The repository serves as a convenient, curated collection of tools rather than an original software application, making it valuable for analysts who need a ready-to-use toolkit.

RisohEditor is a mature Win32 desktop application for editing, creating, and translating Windows PE resources (.exe, .dll, .rc, .res files). It supports all standard resource types including icons, cursors, bitmaps, dialogs, menus, accelerators, string tables, version info, message tables, toolbars, manifests, HTML, and custom binary data. The application provides a visual dialog editor (RADical) with drag-and-drop control placement, a tree-view resource browser, a hex viewer, and a code editor for RC text. It integrates with external tools like windres, mcpp (preprocessor), UPX (compression), and includes an embedded scripting language (EGA) for batch automation. Architecture follows the Win32 SDK pattern with custom MFC-like wrappers (MZC4 library) for window subclassing, property sheets, splitters, and utility classes. Resource parsing and serialization is done per-type via dedicated classes (e.g., IconRes, MenuRes, DialogRes) that implement LoadFromStream/SaveToStream. The application maintains a global resource database (g_res) and constants database (g_db) for ID resolution. It supports 17+ UI languages and can encrypt resources via WonRes submodule. Entry points include MMainWnd (main window) and the command-line interface for batch processing.