HARDWARE
GRAVEYARD. GitHub

EMBEDDED SYSTEMS / REVERSE ENGINEERING

Old hardware.
New possibilities.

There’s more to a device than the firmware it shipped with. I explore what’s underneath — and give abandoned hardware a second life.

Explore the projects Follow the code
01 — THE WORKBENCHOpen hardware. Open findings.
ON THE WORKBENCHC
DIBUK Saga e-reader on its retail boxes
LATEST PROJECT ACTIVITYDIBUK Saga (Netronix E60QH2)
↙
BARE-METAL ARMEMBEDDED LINUXUART & BOOTLOADERSHARDWARE RECOVERY

01 / SELECTED WORK

From forgotten
to figured out.

Real boards. Serial consoles. A lot of questions.
Every project starts with a device worth understanding.

THE HARDWARE ARCHIVE ↙

Showing all 3 projects.

DIBUK Saga e-reader on its retail boxes001 / LINUX
LINUX

DIBUK Saga (Netronix E60QH2)

embedded-re/netronix-e60qh2

Reverse engineering and mainline Linux port for the DIBUK Saga e-reader (Netronix E60QH2, i.MX6 SoloLite, Slovak Telekom)

The Netronix E60QH2 is a 6″ e-ink reader that Slovak Telekom sold under its own brand. It has an i.MX6 SoloLite, a 1448×1072 E Ink panel, a zForce IR touchscreen, BCM43362 WiFi and Android 4 on a 4 GB eMMC. This repository documents the hardware and the stock firmware, and ports mainline Linux to it. The port uses Linux 7.2 and Alpine 3.24 from the microSD, and leaves the eMMC with stock Android untouched. It was sold as the DIBUK Saga, an e-reader paired with the DIBUK e-book store and…

C / ALPINE-LINUX / DEVICE-TREE / DIBUK / DIBUK-SAGA / E-INK

Last push

Explore the repository
KSTB6077 with Telekom branding002 / BARE METAL
BARE METAL

KaonMedia KSTB6077

embedded-re/kstb6077-bcm7268

Reverse-engineered hardware manual and bare-metal AArch64 code for the KaonMedia KSTB6077 (Broadcom BCM7268)

A reverse-engineered hardware manual and bare-metal ARM code for the KaonMedia KSTB6077, an Android TV set-top box built on the Broadcom BCM7268 SoC. Broadcom publishes no datasheet for this chip; everything here was tested on the board or says where it came from. The KSTB6077 is supplied to several TV operators, so the logo on the lid varies by provider (Telekom and COSMOTE TV shown).

PYTHON

Last push

Explore the repository
Board003 / RECOVERY
RECOVERY

DrayTek Vigor2600VGST

embedded-re/draytek-vigor2600vgst

UART reverse engineering and repurposing of a 2005 DrayTek Vigor2600VGST router

The board exposes an unpopulated 4-pin UART header. Connected UART adapter (3.3V logic) at 115200 8N1. This is where things immediately got confusing. The device does not produce clean sequential boot output — multiple hardware subsystems (ISDN, ADSL, VoIP, switch) all print their own diagnostic messages asynchronously, interleaving with each other and with any management prompts. The result looks like this:

Last push

Explore the repository
Everything is documented in the open.Browse embedded-re on GitHub

02 / THE APPROACH

Curiosity is
the starting point.

A product’s end of support doesn’t have to be
the end of its useful life.

[01]

Find a way in.

Open the case. Identify the chips. Find the UART. Follow the boot process and understand what’s already there.

PCB → SERIAL → BOOTLOADER
[02]

Make it make sense.

Map the hardware, test assumptions, and connect the registers to what the board actually does. Keep the raw evidence.

PROBE → TEST → DOCUMENT
[03]

Give it another life.

Bring up a peripheral, boot a new kernel, or put the original hardware back to work. Share enough for someone else to build on.

BUILD → REUSE → SHARE

No datasheet? Start with what the board can tell you.

03 / OPEN A CONNECTION

Something worth
taking apart?

Have an interesting board, a question about a project,
or a piece of hardware that deserves another chance?

EMAILLet’s talk hardware.SOURCE CODE & PROJECT DISCUSSIONSgithub.com/embedded-re