Hacker News Reader

Comment by jzemeocala | Hacker News Reader

I bought an Alesis QS8.1 super cheap in perfect condition (was a top grade digital piano/synth in the 90s).

and then i realized that ALL of the software (which i collected from defunct websites and archived on github) related to it was ancient and after a while of getting tired of using WINE every single time i decided i wanted a cross platform modern equivalent that did everything that several of these different programs did (plus break out some stuff that was now potentially possible with modern computer)

i thought it would be extremely hard because the computer to synth communication is pretty much only via sysex commands (of which the actual wave file encoding protocol was undocumented)

Claude walked me through examining the some of the original software in GHIDRA, and I had a working demo that night.....now im just playing with adding new features to it.

View on HN

Related story, while applying a firmware update to my Kawai CA49 piano, I bricked it due to flashing the wrong file (The process was broken, and I got desperate and tried something stupid, which bricked the piano). Claude walked me through looking for signs of life, and since OTA from the phone app wasn't working for me, it downloaded the Kawai Android APK, decompiled the Java, figured out the hardcoded key used for encrypting the firmware update. Extracted the piano firmware update, decrypted it, and then wrote a flashing script to program the piano from my laptop via bluetooth. My piano was back to working within an hour.

That's sick.

Baller

I can't imagine where we are headed. You understand every step of what it did and can appreciate the complexity but it'll only take a few generations for this to become something like magic to the tech priests beseeching the machine spirits for blessings

I'm not convinced that's where we are heading. LLMs are really good at explaining things ("explain to me like I'm a 5 year old").

Imagine someone in a position of power mandating that LLMs should not be good teachers.

Some manager at LLM provider: "hey, we can sell 'education' ability as a separate product!".

You jest, but I’m actually convinced education-tuned LLMs are (today) the only way education outcomes can actually improve in the AI era. As is, students are leveraging them for doing homework which makes homework useless, you want and economically need a model which can work as a 1:1 tutor with minimal supervision (and some hardware so lessons aren’t keyboard-driven).

> and some hardware so lessons aren’t keyboard-driven).

What's wrong with (screen-, probably) keyboard?

Writing with a pen or pencil has better learning outcomes than with a keyboard for neurological reasons.

https://pmc.ncbi.nlm.nih.gov/articles/PMC11943480/

Most kids can't use a keyboard and never will. Their Apple Pencil scribbles don't seem to make them particularly smarter.

Pen&pencil-> create something from (almost) nothing. Stylus input-> subpar slow interface for computation.

Ipad data storage above par organisational help (no loosing lousy stuffed in bag paper).

I kinda liked the AI to transpose handwritten/drawn notes into digitally orderable artifacts. Seen a couple Show HNs. Are there any advances in the field (preferably OSS or one time purchaseable as alternatively)

(To add on to this: the utter physical imprecision of stylis pens is annoying. I can FEEL where a sharpt tip of a tool that is elongating my hand touches a surface and how it moves on a very fine scale/resolution. Probably not a problem for people who have not developed highly sensitive sensomotor perception because they grew up with a lot of flattness in there surrounding and not much plasticity, but: my god are these things clumsy. I always want to reach for a sharpener when i use an apple pencil lol.

You can buy finer-tipped replacement caps for the mechanical pencil effect. Then there is the second problem: the texture of glass instead of paper.

It's enough to make "explanation" a separate "educational" license to make it less broad used. Or disable it in some countries (this is happening already).

Wait, really? Can you give specifics?

Use VPN and try switching countries for yourself. Start from non-EU ones. You'll see.

This is why locally running LLMs must be the future. We don't all need PHD level AIs to answer 99% of our queries, or to teach us a new thing. I'd encourage everyone to learn how to run and deploy local LLMs, even if they are not quite there yet in terms of performance.

There's a big difference between having something explained to you and developing expertise in it.

I don't see an AI-as-explainer future where expertise isn't sacrificed en masse.

Capitalism rarely supports a currently economically unproductive alternative for future good reasons.

The recent AI tech layoffs are a warning sign that corporate leaders will happily shoot their company's (and the future's) expertise to pad next quarter's financials and trust in 90% correct, but much cheaper, AI.

"There's a big difference between having something explained to you and developing expertise in it."

No, there isn't. You get things explained in University. Then you build on top of this knowledge.

That's not at all how university works.

You are explained things (least important part) and then you invest substantial amounts of time in practicing and exercising those new skills.

Then, in your junior level jobs, the same cycle repeats.

That exercise component isn't going to happen in university with AI in the loop, because AI will be able to shortcut basic practice.

And it isn't going to happen in junior level work, because AI will be able to do those jobs more economically efficiently.

See previous from HN fp for a more eloquent explanation: https://ergosphere.blog/posts/the-machines-are-fine/

A post that lives rent-free in my head points out that a kid who is addicted to chatgpt is going to be more literate - and therefore likely better educated - than a kid who is addicted to tiktok

and both saw the world through an inherited training/feed bias and censorship, hurray!

Just like they always have. There’s a reason religion is mostly inherited.

Everything a human knows has to be learned

Has there ever been a modern time when this wasn't the case?

I mean: I can only go back so far, but I remember the 1980s well-enough. At that time, most of the new information that came into my brain from outside was sourced from public schools, newspapers, and the evening news on TV.

None of these sources were particularly unfiltered, uncensored, or unbiased. It was always an abbreviated approximation of someone else's idea of the truth.

Even in pre-modern times censorship was the norm. Heck, it wasn’t until the printing press was invented that the powers that be had to start doing it explicitly.

I've been writing code since my teens, I've studied assembly... yet the fact that _things_ start happening when I press the power button on my computer are pure magic to me and I like it this way.

I started digging a few times, but, I prefer the "magic".

I prefer at least a superficial understanding.

Hopefully, there will never be a time when at least some folks are not reading books such as:

https://www.goodreads.com/book/show/44882.Code

turtles all the way down

Eh. The only real things you need are:

- On startup processing begins at a known address, and you put the bootloader code over there. Hardware engineers can guarantee this for you.

- Every time you execute an assembly instruction, the program counter either explicitly jumps to a new location or else it just increments by 1. Hardware people can also make this happen as easily as implementing an adder.

Don't get me wrong, there are LOTS of layers between the hardware and most "useful" programs any of us will ever write. But all of them are pretty understandable. They're often not very complicated, just tedious.

Similarly for making a basic CPU that implements the logic you’re describing. In 2006 or so I made a super simple microcontroller on an FPGA for a course project. It had a whopping 256 bytes of RAM, 1kB of ROM, and I think four 8-bit registers plus a 16-bit program counter. You could only jump +/- 256 bytes. It was largely useless but also incredibly satisfying.

Keats blamed Newton for taken the magic out of the rainbow with a prism. Personally I think the magic only got greater.

I'm genuinely puzzled by how you know enough about a system to even understand there is a basic assembly language, but still consider how "switching on" is 'pure magic'.

Doesn't the one explain the other ? It may be turtles all the way down, but at some point there's a fundamental turtle - be it LEA or CMP ?

There is an absolute gulf between knowing what assembly is and a functional computer

Fair. I've just never come across someone who knows what assembly-language is, and who doesn't understand how a computer works. The journey of discovery is usually from the top-down, not the bottom-up.

I think it will be just like Dr. Know in Spielberg's "AI" movie from 2001 — I found it amazing how the oracle, though giving mystic-sounding obfuscated answers, was actually intelligent enough to figure out (a) what the kid was asking for and (2) give the correct answer.

It is amazing how Dr. Know projects where AI is likely to go. And a Kubrick script, no less. Even the commercial overlap, where you pump in coins as the only way to get answers. Did it not also have ads? Truly prescient.

If religion and human technology are any guide, there will be a lot of this but it will never be the entire sum of human activity. Some of us are just too damn curious. We go straight for the curtain. I refuse to believe that very human pattern won’t continue.

Give it six more months and you'll have a second "oh shit" moment when you peek behind the curtain of LLMs shitting the bed.

I guess tech unsavvy people who are easily amused by LLM tricks will always exist, but they'll be an increasingly smaller minority as time goes on.

I think you're overestimating how much the average person knows about how technology operates today, or 30 years ago, or 1000. In some sense, we have been living with magic and tech priests since the Romans built the aqueducts. I wouldn't be surprised if widespread, cheap AI makes it easier for the average person to learn how things around them work, if they are so inclined.

I meet kids today who haven’t heard of Microsoft, who regularly play GTA and hand in assignments made in Powerpoint. 20 years ago I discovered that a friend didn’t know Xbox and Word were both from Microsoft. It’s really hard to understand what is common knowledge in different parts of society.

Indeed. You'd be shocked how few people on Hacker News even know the difference between cross stitch and blackwork.

https://xkcd.com/2501/

Those are just products who cares?

I think the GP is alluding to understanding the fundamental way a thing works.

Kids today don’t even know where the files are stored or anything about partitions, drives, directory structure or even how much disk space is available.

They have some files, synced to OneDrive and do everything else fully online (Canva, etc.)

Most of them have never seen a computer with a drive other than C:

Kids today don't even know the most basic x86 assembly instructions! A whole class of third graders, and not one of them could tell me the difference between MOV and LEA!!!! Can you believe it?!?!

Apt username.

My son has never seen a C: drive before. Heck, we got him a Macbook Neo a few weeks ago and I don’t think he has left more than a few coding apps since then. Thankfully he isn’t using AI yet.

Kids in college 20 years ago didn’t know that either. Some of them didn’t understand that they had a school email address.

The point is, eventually not even experts will understand what it's doing

I'm always shocked by the amount of people that have been looking and using refrigerators their whole life.... And have zero idea how it works.

  > widespread, cheap AI makes it easier for the average person to learn how things around them work, if they are so inclined.

It looks to me that the far more common use case will be to manipulate technology rather than understand it.

The example with the synth is excellent. Today that kind of work demands somebody knowledgeable operate the AI harness. In short order, the AI may very well come up with the solution of looking online for example programs to decompile without the user even understanding what that means.

To your point, we would think that just because we gained access to a vast mass of knowledge via web archives (such as Wikipedia), people would have become smarter overall, that no person with access to this would choose not to acquire the knowledge at hand. But here we are, surrounded by people who choose to stay ignorant. So, I imagine the same will happen with AI. The vast majority of people will keep using their chatbots and never in their lives will they solve their problems with these tools beyond asking general questions for troubleshooting.

I don’t think much of them will be inclined to since information and “knowledge“ will be easily available via a prompt in any LLM. They won’t care to know what’s going on under the hood of anything. I mean, they already don’t want to and they have Google, Wikipedia and all sorts of things available to them.

Honestly, don't think so. That's certainly the path one might extrapolate if the next generation grows up exactly the same way as the current generation, but that's not how it works.

They will be exposed to this technology throughout childhood as their brains develop and they will develop unique ways to work with it we don't entirely understand just like GenY with cell phones and GenX with home computers. I think you deeply underestimate how adaptable we are as a species, but if you consider that we've been running the same OS and Bios as a species for the past ~40K years, perhaps you might be more optimistic?

As I recall, the Dr. knows were programmed to feed that information to runaway mechas who, who were, in turn, programmed to seek out the blue fairy.

Probably a lesson in there somewhere.

"In the distant future, humans live in a computer-aided society and have forgotten the fundamentals of mathematics, including even the rudimentary skill of counting.

The Terrestrial Federation is at war with Deneb, and the war is conducted by long-range weapons controlled by computers which are expensive and hard to replace. Myron Aub, a low grade Technician, discovers how to reverse-engineer the principles of pencil-and-paper arithmetic by studying the workings of ancient computers which were programmed by human beings, before bootstrapping became the norm—a development which is later dubbed "Graphitics"." [1]

[1] https://en.wikipedia.org/wiki/The_Feeling_of_Power

I’m all for the sci-fi extremes that we might lose valuable skills to cognitive delegation, but the idea that we as a society will forget how to count is… extremely stupid.

To be fair, the average person already doesn't know how to do simple arithmetic.

Kids grew up on this man, they are master prompters. You’ll be asking them to fix your holoTV and your crypto phone when you’re too old to read the brainfuck.

yeah thats mind blowing, ngl

This is truly remarkable. Congratulations!

Yes, those tools are extremely good at reverse engineering. With a bit of know how, it is now trivial to reverse engineer any protocol or crack any software, often in a matter of hours or less.

A lot of people in the industry have vested interests in this not being discussed openly so you don't hear too much about it, but the implications are huge.

What are some of the implications? Where does widely available mythos-level hacking lead? By people with a vested interest, do you mean non-cloud software vendors?

Software that had a data moat because it was hard to integrate with or migrate off of will have that moat disappear. A web site is a client now. Building data migration too for all of you competitors is easier now.

One of the many SaaS products we use at Day Job chose to gatekeep its MCP behind an enterprise plan. A brief Claude Code session later and a better, more feature-full MCP than the official was reverse-engineered from internal APIs by Opus.

I've just had a SaaS that I use decide to implement a 2.4x price increase. I reacted instead by taking screenshots of every page of the SaaS, downloading their API docs, exporting what data I could, and asking Claude to build a self-hosted clone based just on those files. I had a read-only version of my entire data history completed in a single evening. Even at Opus API rates, it cost me less than half the price of a single annual seat.

Heh and without api docs, just copy and paste the urls from network traffic and Claude will write a library for you.

Right now, software is protected by the attacker not having enough competence. If that's over, the logical next step is using real encryption.

E.g. a synth has a public key embedded. To change settings, you upload them to the vendor, who blesses them with their private key.

Hacking such a synth requires either jailbreaking the synth, or the vendor losing their key . Both can be mitigated with tamper resistant hardware.

We're well ahead on this path already, I assume AI will accellerate it. This is very bad news for the right to repair.

But everything you described was basically a byproduct of incompetence somehow no? On both side. That's why the right to repair and how local HW should be treated when the online counterpart is EOLed by the manufacturer should be mandated by law. A law that stands on the side of the citizen, the end-user, obviously.

I would not describe it as incompetence, more as

1) current encryption not available in the 1990's. These are the age of DES and weapon-grade vs commercial encryption. There was a legal cost blocking strong encryption.

2) Manufacturers were not as strongly opposed to people touching the internals. After WW2, most people could fix anything, because survival depended on it. Even in the 60's radios etc. came with schematics, and building your own was normal and cost-effective. The shift happened in the '90s, with governements requiring licensing for everything, and mass manufacturing making repair less cost effective than buying a new one.

Our current culture where only people blessed by the manufacturer are allowed to do anything is very recent.

(Reads:) "But, but...but... but everything... you described ...basically seem to be somehow a byproduct of incompetence...no"

[trying-to-generate-random-making-sense-content]

Let me gasps ask: The older six-fingers-"AI"-characters had learned an music-instrument by now, ander are much more capable of playing music you otherwise haddn't known or thought about..."?

um What about those early shadowy boygroup, whom seem asian, no ? (-;

[after-losing-entry-address-of-topic-question]

But back to your trustworth-written text, Yes!

regards,

I think companies with valuable data to scrape (e.g. media companies) will eventually lock it behind APIs that verify Apple App Attest or Google Play Integrity. And deprecate websites which are easily scraped too. Then it will be useless to reverse engineer APIs used by apps and we will have to run the unmodified client on an unmodified OS.

What do you mean? Everyone is talking about Mythos.

I think GP is talking about cracking, not pen testing.

Those are the same thing. They're talking about decompilation and protocol analysis.

They're talking about patching Claude Code.

Some people even had some fun de-minifying JS and disassembling binaries. Successfully.

It wouldn't surprise me if reverse engineering is put on the "highly unsafe" list in the near future in the same category as bio because of these interests. Can't have the cattle classes be able to control their own property now can we?

This is pretty much a given anyway. Making reverse engineering tools is already likely to get you sued by someone so model makers are apt to slow down the ability of their tools to reverse engineer to avoid the lawsuits themselves.

Heh finally the impunity of the NSA is good for once. Good luck suing them over Ghidra

>Claude walked me through examining the some of the original software in GHIDRA,

I wanted to be able to decrypt the files on The Complete New Yorker magazine DVDs. The old software was WinXP only, and crashed by the time you turned to page 3 or 4. It walked me through using Ghidra on the relevant dll, mapped out how it was using Blowfish, what the credentials were that it was passing, and re-implemented all of that in a python script.

Now all the files are in plain pdf.

Right now, it's helping me write an extension to the mkv specification for embedded scripts and modify VLC to be conformant, so I can watch Black Mirror Bandersnatch. Already have a buggy implementation, about 3 days in.

I've also had it add BEP 46 mutable torrent functionality to Transmission (and to some extent, to the WebTorrent library).

These are all well beyond my abilities to do casually, and probably beyond my ability to do even if I spent the next 18 months doing nothing by grinding away at it.

I only replied because I thought it curious that Claude apparently favors Ghidra.

Interestingly enough, i’ve been sitting on a project for the last 12ish years where i just took the FMloader lib and used that from C# to turn the djvu files into pdfs. All that was needed was a decompiler and an hour of banging my head on it. I published some of the results a few years ago but need to go back and actually build out a full app.

I'm trying to not do the naive pdf creation, where each page is just the raster. Trying to keep the JBIG2 bilevel, as I get better quality at lower file size. Using jpeg2000 too, where appropriate, but the pdfs are still x2.5 the size of the original. Though, I can have it spit out decrypted djvu files that are exactly the same filesize... I just don't like that format for archival.

If you want the Rolling Stone or Playboy archives decrypted, ReconSuave on github has tools to do those. I got tired of waiting for him to do The New Yorker though.

Ive mainly been outputting them to high fidelity jpegs and then stuffing them into a cbz for portability. Works well went im reading on my ipad. As for the others i had them sorted out about a week or two after i decompiled the original binaries.

I’ve definitely kicked myself a few times for not posting about them sooner, but the fear of pissing off CondeNast tempered my willingness to show off

I don't think CondeNast cares.

Do any of the cbz readers handle jpeg2000? It makes a big difference in filesize without any quality degradation. Like 40% smaller, maybe more in some cases. You should tinker with that if you have the time.

Okular handles cbz that contain jxl with no issue. (IIUC both archive format and image format support is provided via a pluggable extension system but I don't recall the details because my setup has "just worked" for a very long time now.)

Also FYI you can use mupdf to read cbz archives although I don't personally recommend it for that usecase.

What was your setup for this and did you have any preferences set in Claude to get started with something like this?

I use Claude on the desktop, and only occasionally Claude Code. It's the one that recommended Ghidra. Walked me through the install. Taught me the basics (G to go to an address, etc). Would tell me where to go, and what to paste back to it. It eventually converged on where to find the iv and credentials and so forth (after acting confused for awhile), and then wrote the python script for me that decrypts. I'd like to think my questions (and challenges to its assertions) were intelligent enough to spur it towards the solution, but self-flattery is all that is.

The dll in question was pretty obvious just from the filename alone that it was where the magic happened.

If you want something similar, you might just start by asking it if it would be feasible to decompile the software in question to reverse engineer the decryption, that you'd heard Ghidra was a big deal. Keep nudging it to guide you along that sort of path.

Ooooh, you don't happen to have the code for the New Yorker decryption in a form you could send, do you? Or put up on github or even just give me the starting prompt…

Okay, a couple of hours later…thanks for the hint as that's fucking dark magic ;) and I now have access to the entire New Yorker again after around 15 years :)

Since I think you'll find the one for Rolling Stone and Playboy, but not The New Yorker (I might be one of the few that has this or something like it)...

https://gist.github.com/NoMoreNicksLeft/d3a4a59c7b4de0cdef1e...

I'll have a more proper github repo at some point, but there are bugs I was working through. Some issues are bloated up ridiculously... a 9mb djvu file shouldn't become a 110mb pdf. Most issues will work well though. Hope it helps.

I would be interested to learn a bit more on the how after reading also [0] and the worlk done on patching the Ableton Move firmware with the Schwung [1]. Slightly different but there is an increasing amount of work done on either old hardware and new one exploring patching, swapping or developing new firmware from scratch thanks to LLM/GenAI currently.

[0] https://mforney.org/blog/2026-05-28-patching-my-guitar-amps-... [1] https://schwung.dev

Schwung is great. See also the recent new firmware for the Elektron Monomachine (old unsupported hardware) created using LLMs

With stuff like this, do you honestly not feel that you've probably been tricked and that someone else actually did this?

Don't get me wrong, I think AI can do some surprising things, but with stuff like this, often it just stole the code and the steps without attribution, it didn't figure it out.

There'll probably be a blog post detailing exactly how to do this somewhere and Claude just copied the steps and code.

And worse, Google search would have found it 10 years ago, but Google search today would claim there are no results?

I think incredibly specific stuff like this often won't pass the 'did Claude just steal this?' test when you dig into it.

It was probably done on a foreign language on an archived forum. Claude is the improvement of the internet search box.

I take it….

Improvement over all the assholes that tell you „just google it” after you spent two days hitting the wall.

I appreciate where you’re coming from but no, I don’t believe so. I have had Claude do some incredible reverse engineering on very proprietary niche firmware blobs that aren’t generally available to the public. One of the really interesting reasons why I don’t believe that it’s simply regurgitation but rather iterative novel synthesis is because of the dead ends and blind alleys that led to success. It feels a lot more like “Claude has read every tutorial on Ghidra and Radare2, and has memorized the ARM architecture and datasheets for all of these microcontrollers”. Misidentifying, say, which subfamily of processors it is based on the IVT, only to course correct when I give it the VID/PID of the device booted into DFU mode.

One piece of gear, Claude found a hidden and highly useful diagnostic screen. This took a few iterations too. It found the existence of it based on just running “strings” against the firmware image but needed a few rounds of me going “I tried what you suggested but this is what happened instead”. Searching Google, DuckDuckGo, and GitHub for any of the strings that were on that screen or any of the named constants associated with that screen in reverse engineered source led to exactly zero hits.

More entertaining, Claude and I together also nailed down the source of a PTP synchronization bug in a piece of equipment a few months ago using the main UI .exe (written in pascal, of course), an ARM Linux image from the real-time controller in the box, and some pcaps from it interacting with other devices. The vendor released a patch a few days ago, without me having reported the bug.

I had that keyboard! I actually really like the piano-ish touch. I remember being sad though, when I realized they’d crammed all the sounds into I think 16MB (or was it 8?) and realizing how bad that was even by the late 90s! I think I still have mine in the garage somewhere… good times!

You mean bad because they could have used a larger memory module and thus higher resolution sound samples?

I loved mine. Had it since the 90s, working perfectly.

One day a few years ago my dad came by and was admiring it (it was a QS8) and asked to borrow it so he could play piano again.

I, of course, said sure, but was feeling a little salty about it inside, because I wanted it to play, that's why I had it all set up.

Anyway, about a year went by and I asked him about it to see if he was done with it.

He said "oh that thing? I gave that away, was just taking up space"

-.-

Hey so... mind sharing findings? I have a QS8 :)

While not the "oh shit" moment, the wave has the same shape.

I have an DigiTech GNX3000 effects pedal board - a digital modeling "workstation" that needs the aged Windows native software or Gdigi to make the most of.

At best, the experience with gdigi was passable; raw access to the patches and controls, the ability to control it from the laptop, etc.

In an hour or so, I had a functionally superior webmidi version up and running in Vercel using their v0 code. It kicked off a wave of subscriptions and referral chasing.

I made it a template - because there are so many gnx3k users out there: https://v0.app/templates/digitech-gnx3000-sysex-tool-GC5LzXA...

That's fantastic. Did you use a Ghidra MCP server? It's kind of magical huh?

I've done a similar sort of thing with my camera lens' firmware updater just out of curiosity, and I didn't use any kind of MCP. It's able to write an automated script using the Ghirda API to decompile the program just fine, and then code exploration can be done by reading the code.

Claude needs good variable names a lot less than humans do, so renaming/typedefing doesn't seem to be as necessary.

Reply on news.ycombinator.com