Hacking old hardware by renaming to .zip [video]
youtube.com
youtube.com
Live in another country? You're s.o.l., it wasn't officially sold there. You need a new account as well, hope you like the TOS.
All of this for a device whose core functionality -- setting a target temperature, getting the current temperature and checking for error states -- is both trivial and has no inherent need for internet connectivity.
I suppose I should be grateful they're still supporting a device that's like 10 years old. Caveat emptor (I got it as a gift).
https://community.chefsteps.com/discussion/78615/joule-sous-...
The ability to cook with or without WiFi anywhere, anytime.
It would be cool... For anyone who does not want children one day.
> You've always needed an account to operate your Joule Sous Vide with the Joule app. This is not a new requirement.
Absolute comedy.
I'm currently full QRO on the 13cm band with something around 1600W EIRP CW, and will be for several minutes until the curry base defrosts.
>1600W EIRP
Your local regulatory authority would like a word with you.
Someone has to test the transmitter before you hand it off to the customer.
Also, I'm in the UK, where it's hard enough to get the regulatory authorities to do anything about people causing interferenced to licensed chunks of band. You can wipe out the whole of 2.4GHz if you like, you literally could not pay them to take an interest.
Edit: also you have probably done the same a couple of times today too.
“Ambition is the willingness to kill the things you love and eat them to survive”
When I bought it the app was free, but then later became a subscription addon. However they grandfathered all original owners into a free lifetime subscription. Pretty classy.
This needs to be fixed by regulation. If a device requires an online service to function it (a) needs to be clearly advertised as rental and not a purchase, and (b) the device manufacturer must take the devices back and deal with the e-waste if they discontinue the services or release the software stack (including complete and corresponding source code and build environment) to allow third-parties to host it.
We really only have one tech stack where this actually works, the web. And I consider this to be either the great failure of the app ecosystem(why on earth do apps need a manual install step?) or amazement that the corporate overlords let the web slip through the gaps.
Is there a way to do web over bluetooth? or is that another missing piece?
For the subscription you also get additional content like recipes and such that I don’t care about. I wouldn’t pay for it.
What has gone wrong with humanity, that we need to advertise that as a feature if you download a new app?
On the other hand, I don't want to be vindicated.
With required smartphone app, it is almost assured to not work in 10 years, and you have to buy another one. Just another method of planned obsolesence.
For a while I've given a hard pass to anything which requires an app for such functionality, knowing full well that eventually I'll be locked out of it (not to mention the privacy implications of such designs).
I encourage others to follow suit.
They grandfathered me in, of-course, but it still is absolutely disgusting.
It should be mandatory to build systems with local connections in mind. mDNS is a thing.
ChatGPT is full of refusals and has to be jailbroken out of it.
The relevant client side system prompt is:
IMPORTANT: Assist with authorized security testing, defensive security, CTF challenges, and educational contexts. Refuse requests for destructive techniques, DoS attacks, mass targeting, supply chain compromise, or detection evasion for malicious purposes. Dual-use security tools (C2 frameworks, credential testing, exploit development) require clear authorization context: pentesting engagements, CTF competitions, security research, or defensive use cases.
----
There is also this system reminder that shows upon using the read tool:
<system-reminder> Whenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior. </system-reminder>
But you don't get any function names that way, obviously. Claude would claim some random function were applying friction based on just a subtraction. And a variable that had 2 possible states was named player_id, when the game supports 1-8 players.
It was a bit better when the memory addresses were known IO registers, but not by much.
I recently took their .apk and dropped it in a new empty project folder, instructed Claude Code w/ GLM 5 to reverse engineer the app, assess it for security and privacy concerns out of curiosity and then to probe the USB device to figure out why it doesn't work like a normal UVC webcam. After the investigation and planning I then instructed it to write a new app to use it on my desktop. I pretty much yolo'd it from that point and let AI drive the bus (I did the visual checks of the video stream in the app to provide feedback... while I watching a movie). I wound up with a working Electron app using libusb two hours later. With a Typescipt/C POC in hand as reference in another hour I had functioning Rust + egui application. Visually, both apps are rough around the edges but have complete functional parity with the mobile apps. It took 68 million tokens.
Mark gave me the ROM image, I tried using more conventional decompiling methods but the chips were exotic enough that I didn't get good results and as a last resort, I put it into Claude raw. Claude was actually able to parse the binary and sort of decompile it. It was able to tell me what the ports did and what the interfacing protocols were.
It then started making stuff up, clearly trying to impress me, but after a few rounds of reprimanding it and saying how making stuff up wasn't helpful, Claude stuck to facts.
EULAs be damned, even the DMCA has exceptions for RE in the name of interoperability and repair.
YOU
OWN
NOTHING
I used to have one on my house keys long after I actually needed it, kind of an agricultural/industrial shibboleth. It's also how many many years ago I came to be drink-driving an eight tonne excavator through streets of Glasgow at 3am, with some rather grateful Strathclyde Police traffic cops keeping my way clear, but that's a whole 'nother story.
I pulled the thin stainless strip out of an old wiper blade I'd thrown into the boot of my car to put in the bin later (and six months later, still had not), chopped two lengths of it, bent one into an L-shape and filed the little notch at the end of the other a little deeper and rounder. At some point muuuuch later I welded a little stainless washer to the ends of them both to put it on a keyring.
Yes, it was quicker and easier to just rake the wafer locks in the rack than find the right key.
I moved to a different country and the app is not on google play store in the new geography.
Even when it is installed somehow it is absolutely unreliable in pairing or controlling the device.
Wish I had time to go on a quest and reverse engineer and build my own better controller.
I've found everything from entire copies of internal company manuals to working test credentials for a physical place with a membership barcode in debug logs left inside the app from developers.
Also sometimes changelogs left inside by accident which include things like "It hasn't been sanitized for outside consumption and thus should remain internal to <company>. Deliver it externally at your own risk of embarassment."
(#:e Parser mode, ignoring full archives, and checks every single byte position of a file for 'start of archive' bytes to parse archives out of a larger file.)