Foreword¶

People doing embedded firmware reverse engineering often encounter the same type of problem: devices without source code, vendors have exited the market, flashing interfaces are not public, and changing one wrong byte can brick the device. In such tasks, “how to flash safely” and “how to verify if a hypothesis is truly true” are often more tricky than simple disassembly. gladess1102/legacy-firmware-reversing compiles practical experience from 26 versions of real-device firmware running on the Sharp MP-B300 (SigmaTel STMP3560 · Motorola DSP56004 · Sanyo LV24002) in the summer of 2004 into an deliverable Agent Skill and DSH plugin. The “reversing” in the plugin name refers to the entire workflow, not a single tool.

What is this¶

One-sentence positioning: A set of firmware reverse engineering, full localization, and safe flashing methodologies for black-box legacy devices, distributed in two forms: Agent Skill guide and DSH plugin.

• Maintainer: Gladess1102 (gladess, Little G), device owner, real-device operator for 26 flashes.
• Category: Workflow (Community directory SkillHub).
• Stars: 1 (as of 2026-11).
• License: MIT; not affiliated with Sharp, SigmaTel/Freescale, or Sanyo.
• Background: Methodology distilled from a multi-Agent collaborative black-box assault on the MP-B300; the full campaign record is in the repository case-studies/MP-B300.md.

Regarding the repository structure, SKILL.md serves as the Agent Skill entry point, references/ contains five in-depth guides, templates/ provides templates for PROJECT-STATE, experiment logs, safe_flasher.py, surrogate_stub.S, etc., and lib/ and bin/ constitute the plugin code and independent CLI.

Core Functions¶

The methodology is divided into five pillars, which form the main content of the plugin:

1. Zero-brick protocol reverse engineering. Vendor SCSI command parsing, USB BOT short packet termination traps, sector footer whitelist, protected page assertions, and rollback chain requirements must be preset before every flash.
2. Private resource tree reconstruction and full localization. 24-bit binary descriptor parsing, visual anchor recovery glyph mapping; the MP-B300 project injected 6,763 GB2312 glyphs in-place into the Japanese font library, keeping the total mirror size unchanged by a single byte.
3. Heterogeneous DSP disassembly + PC JIT emulation stubs. Instead of reverse-engineering the entire kernel, only stub out call points, run modules on xemu-project/dsp56300, and do full memory diffs on two critical inputs (89.9 vs 90.0 MHz).
4. Falsification prioritized over inference. Each hypothesis relies on single-variable modification and human ear observation for judgment, using EXPERIMENTS to register discipline and distinguish between “phenomenon changed” and “conclusion wrong.”
5. Multi-Agent anti-drift collaboration. Using PROJECT-STATE.md as the single source of truth, three heterogeneous Agents (DeepSeek, Gemini, GLM) take turns on the same campaign without repeating each other’s dead ends.

At the code level, the plugin registers a fw-recon cordis service: the safety gate (size/protected page/sector footer whitelist), dual-image diff, and experiment formatter are all implemented as pure functions in lib/core.js. The plugin declares zero runtime dependencies, Node version requirement >=18.

Installation & Enablement¶

As a DSH plugin installation (commands from the original repository README):

# Install package and mount automatically via the built-in cordis.patch.yml
dsh plugin --profile <profile> add github:Gladess1102/legacy-firmware-reversing

# Or use a local directory
dsh plugin --profile <profile> add /absolute/path/to/legacy-firmware-reversing

After installation, DSH needs to be restarted. The fw-recon service registered by the plugin is for other plugins to consume via ctx.get("fw-recon"); it does not add a new tool to the model’s tool list. The CLI below is independent of DSH and can run with or without the plugin installed.

Desktop App users note: Since DSH 0.2.1-rc.2, the CLI will hard-code reject the desktop profile. Please install via the App’s GUI plugin page, or enter ~/.dsh/profiles/desktop and use pnpm add to install directly and write the package into that profile’s dsh.profile.bundles. Restart the App after installing via either method.

Experiment logging writes to the config item workDir. This value defaults to empty and will not create directories on anyone’s desktop out of thin air. Before the first call to logExperiment, set FW_RECON_WORKDIR or fill in the plugin settings card.

Using it as an Agent Skill is simpler: put the repository in the skills directory (or symlink), or feed SKILL.md as context to the Agent when facing a black-box firmware task, and load references/ as needed.

Typical Usage¶

The independent CLI provides three sub-commands; commands and examples are from the repository README:

# Pre-flashing safety gate, asserts size / protected page / sector footer whitelist
fw-recon check  --img new.bin --baseline factory.bin

# Dual image diff, strip sector footers to make code comparison clean
fw-recon diff   v10.bin v27.bin --strip

# Falsification experiment logging, enforces "write expected before observed"
fw-recon log    --id E27 --hypothesis "upper-limit checks gate the mute" \
                --action "NOP 2 jlt at 0x16b03/0x16b2d" \
                --expected "cliff moves above 108MHz" \
                --observed "cliff still at 90.0, boot normal" \
                --verdict falsified

check is the last gate before touching the device: if any assertion fails, flashing should stop. log enforces the expected-before-observed order, which is the concrete form of the fourth pillar of this methodology.

The rollback chain also has a corresponding skeleton: templates/safe_flasher.py places assertions before operating on the device, and templates/surrogate_stub.S is the DSP56300 stub template, accompanied by a list of known pitfalls.

Applicable Scenarios & Notes¶

Suitable for: Having a legacy device without source code or public flashing docs on hand, needing to do protocol analysis, resource repositioning, localization injection, or DSP-side hypothesis verification without relying on luck; or multiple Agents working on the same set of experiments, needing a single source of truth to prevent stepping on each other’s toes.

Not suitable for: Expecting the plugin to add a “one-click flashing” button to the model’s tool list. It does not provide such tools; the flashing skeleton is a Python script running on the device itself, and risk judgment is still borne by the human.

The precautions are fully written out:

1. The plugin runs with the permissions of the current DSH process. Read the source code under lib/ and bin/ before enabling to confirm there are no privilege escalation operations.
2. License is MIT, available for commercial use; the repository does not redistribute vendor documentation, and real-name acknowledgments in CREDITS.md must be preserved when forking.
3. workDir is not set by default, do not expect it to take effect automatically; without configuration, experiment logs have nowhere to land.
4. The desktop profile uses GUI installation in the new version of DSH; check your DSH version before deciding which path to take.
5. The repository has only 1 star; project maintenance status and activity need to be evaluated by yourself to decide whether to rely on it long-term.

The community directory SkillHub is an independent site with no official affiliation with DeepSeek / Hypersphere; this article only writes it as an entry point for collection.

Conclusion¶

The value of this plugin lies not in providing some mysterious tool, but in codifying rules like “zero-brick flashing,” “falsification prioritized,” and “multi-Agent anti-drift” into specific operational norms and template files. If your work scenario happens to be on black-box legacy firmware, you can start from the five guides in references/ and use the check/diff/log trio of fw-recon to bring the discipline to your local environment.

• Directory Page: https://www.skillhub.cn/plugins/Gladess1102/legacy-firmware-reversing
• GitHub: https://github.com/Gladess1102/legacy-firmware-reversing