How to use Claude to investigate proprietary firmware
Claude helped an author investigate proprietary firmware through iterative device feedback, uncover a hidden diagnostic screen and identify the source of a PTP synchronization bug using executables, a controller image and packet captures.
news.ycombinator.com
Suggested prompt
Suggested prompt written by Agents In Use, not the source author. Replace bracketed inputs and review tool permissions first.
Investigate [firmware image] for [diagnostic behavior or protocol issue]. Track processor assumptions and revise them using [device identifiers]. Propose testable explanations, ask for observed device results, and use [executables and packet captures] to examine the suspected fault.
Reach people exploring AI agents
See placements →Evidence at a glance
Sourced account- Source poster / publisher
- tonyarkles
- Original account
- Read the source ↗
- Published
- Source link checked
- Reported result
- The author reports discovering a useful hidden diagnostic screen and identifying the source of a PTP synchronization bug. A later vendor patch was released without their having reported that bug.
- Human involvement
- The author tested suggestions on equipment and provided device identifiers and observed behavior to steer the analysis.
A linked account supports attribution. It does not mean we independently reproduced its result.
Report an issue with this case
Open correction emailOpens your email app with the case link included. Nothing is sent automatically.
How the agent did it
- Analyze proprietary firmware and infer the processor subfamily.
- Supply the device VID/PID from DFU mode to correct the processor identification.
- Run strings against firmware to locate evidence of a diagnostic screen.
The author describes using Claude to reverse-engineer proprietary firmware blobs for niche equipment. Their account emphasizes iteration: initial interpretations sometimes failed, and information from the physical device helped redirect the investigation. In one example, Claude misidentified a processor subfamily from the interrupt vector table. The author supplied the device's VID/PID while it was booted into DFU mode, allowing the analysis to course-correct.
On another piece of equipment, Claude found evidence of a hidden diagnostic screen by running strings against the firmware image. Finding a way to reach it required several rounds of the author trying suggestions and reporting what actually happened. The author describes the resulting screen as highly useful. Searches across Google, DuckDuckGo and GitHub found no matches for its strings or associated named constants.
The post also reports a separate PTP synchronization investigation. Claude and the author used the main Pascal UI executable, an ARM Linux controller image and packet captures of interactions with other devices to identify the bug's source. The vendor subsequently released a patch, although the author says they had not reported the bug.
Who it's for: Engineers who can supply firmware artifacts and test proposed explanations against real equipment.
Prompt
Suggested prompt (written by Agents In Use, not the author's)
Source: Hacker News · tonyarkles
Frequently asked questions
What did the human contribute during the analysis?
The author supplied a device VID/PID to correct a processor assumption and repeatedly tested diagnostic-screen suggestions, reporting the observed behavior back to Claude.
Did the author cause the vendor's PTP patch?
The source does not establish that. The author says the vendor released a patch a few days earlier without them having reported the bug.
More details
Remaining steps
- Test suggested access methods and report actual device behavior.
- Investigate a PTP bug using the UI executable, controller image and packet captures.
About this account
Claude performed iterative firmware analysis and proposed explanations and device actions, while the author supplied corrections and test results.
Platform: Hacker News. Attribution: https://news.ycombinator.com/item?id=48431494. Prompt: Suggested (written by Agents In Use, not the author's). Sourced by the Agents In Use pipeline.
Credit: tonyarkles on Hacker News
Source published
Added to Agents In Use
Source checked
Tools and topics
Claude · strings · Firmware images · Packet captures
Firmware · Reverse engineering · Diagnostics · PTP
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.