← All Series
Reverse Engineering
4 parts · ~128 min total
March 26, 2026 · 51 min read
Reverse EngineeringPythonUSBHIDI2CSMBusTIEV2300ctypesWindowsLinux
The Problem
A $200 USB Adapter Held Hostage by Proprietary DLLs
Texas Instruments makes the EV2300—a USB-to-I2C adapter for talking to their battery management ICs. It’s the standard tool for the BQ76920/BQ76940 evaluation boards. Plug it in, fire up bqStudio (TI’s official GUI), read some registers, write some registers. Simple.
Read more →
April 2, 2026 · 20 min read
Reverse EngineeringSTM32USBHIDI2CSMBusTIEV2300FirmwareEmbedded
“started from the bottom now we’re here” — Drake
From Python Driver to Firmware Clone
In Part 1 I reverse engineered the EV2300’s HID protocol and built a pure-Python driver that talks to the real adapter without TI’s DLLs. That solved the “no scripting interface” problem—but we still needed the physical EV2300 hardware. At $200 a pop, with a supply chain that’s been spotty since 2020, that’s not great for a university lab with 30 students.
Read more →
April 2, 2026 · 32 min read
Reverse EngineeringGhidraSTM32USBHIDTIEV2300DLLCRCFirmware
“I’ve been through the desert on a horse with no name” — America
The Timeout That Wouldn’t Die
After Part 2 I had bqStudio reading registers through the STM32 bridge. The silent command fixes got the GUI working. But the DLL path—bq80xrw.dll’s ReadSMBusWord—still returned “EV2X00 Adapter USB Timeout” every single time.
Read more →
April 9, 2026 · 26 min read
reverse-engineeringandroidfire-tv
A streaming service had a Fire TV app built with a white-label app builder platform. We wanted to extract every piece of data it uses – content feeds, video URLs, thumbnails, API endpoints, the intro video, every asset – so we could rebuild the app from scratch with our own architecture.
Read more →