reverse-engineering
- My guard read the tool's name, never its arguments
Loosening the Ghidra MCP rules for my coding agents turned up a hole: the guard judged tools by name, so it never checked which path an import was given.
- FiiO X1 FTL reversed: the map was in the OOB bytes I never dumped
The FiiO X1's flash translation layer rebuilds its block map from the spare bytes of each block's first page. My NAND dump kept 2,048 bytes a page.
- FiiO X1 PCM5142 DSP blocks: the flat head I believed
Three FiiO X1 firmware blocks the DAC loads per stream looked like passthrough filters, until the decoder read all 2,708 bytes of each one.
- Carving a SQLite database from a FiiO X1's raw NAND
One SQLite header in a FiiO X1's 128 MB NAND dump: a malformed carve, sqlite3 .recover, six of my own tracks and a previous owner's ten favourites.
- FiiO X1 EQ table: seven register bytes my generator never read
Decoding the FiiO X1's PCM5142 EQ coefficient table: the format was fine, the register bytes were not, and my first proof of the layout was wrong too.
- FiiO X1 bare-metal audio: four GPIO offsets, all wrong
A bare-metal sine-wave test for the FiiO X1's PCM5142 DAC built clean; two code reviews forced 16 fixes, including four GPIO offsets. None of it ran.
- FiiO X1 Rockbox bootloader: 12 KB of SD, FAT32 and a menu
A bare-metal dual-boot loader for the FiiO X1: SD reads, a FAT32 driver, a cache flush that review caught, 12,512 bytes. Built and reviewed, not yet run.
- HTC Desire Z GPS: the Ghidra fix that landed 235 km away
Ghidra showed why the HTC Desire Z GPS library drops intermediate fixes. Turning that off gave a position in seconds, about 235 km from the phone.
- FiiO X1 EQ presets: floats in .data, not a NAND cache
Ghidra shows the FiiO X1 never reads its eq.ini back: preset gains are floats in .data, reloaded each boot. Nine new presets showed after a factory reset.
- FiiO X1 bootloader in Ghidra: 94 functions at the wrong base
The FiiO X1's bootloader looked like 94 opaque functions until a re-import at 0x80600000: 237 functions, no integrity check, and its SDK source on GitHub.