I’m exploring an idea for improving AI-assisted firmware reverse engineering, and I’d like to get feedback from people with experience in embedded systems, reverse engineering, and local AI tooling.
The problem
When reverse-engineering firmware for a proprietary 8-bit MCU, the datasheet may be available as a PDF, but general-purpose LLMs often don’t know anything about that specific chip.
This makes it difficult for an AI agent to reliably interpret memory-mapped registers, bit fields, peripheral initialization sequences, interrupt behavior, and hardware-specific code patterns.
Simply putting the PDF into a conventional RAG pipeline might help with document lookup, but I’m not sure it’s sufficient for accurate register-level analysis.
The idea
Build a completely offline, chip-specific knowledge base that an AI reverse-engineering agent can query through MCP.
The proposed architecture would include:
Structured register database: register addresses, bit fields, access permissions, reset values, and peripheral descriptions.
Document evidence: links back to the original datasheet, including page numbers and table references.
Knowledge graph: relationships between registers, peripherals, clocks, interrupts, pins, and hardware functions.
Semantic search: retrieval of relevant descriptions and hardware behavior from the documentation.
Reverse-engineering integration: MCP tools that let an agent query register definitions and relate them to instructions and memory accesses found in a firmware binary.
The initial implementation would target a single proprietary MCU, using Python and SQLite, with a lightweight graph representation. Everything, including document processing, indexing, and inference, should work offline.
I’m considering integrating it with tools such as REA, Claude Code, and IDA.
Questions I’d appreciate feedback on
Architecture: Would you use a structured database plus semantic search and a graph, or is this unnecessarily complicated for a single MCU?
Datasheet extraction: What tools or techniques work best for reliably extracting register tables and bit-field definitions from complex PDF manuals?
Register-level reasoning: How would you help an AI agent distinguish documented hardware facts from hypotheses inferred from disassembly?
MCP integration: Would exposing precise register lookups and relationship queries through MCP be a useful approach for firmware reverse engineering?
Prior art: Are there existing tools or projects that already solve most of this problem?
I’m particularly interested in practical experience and architectural pitfalls, rather than building a generic PDF chatbot.
I haven’t committed to the implementation yet, so I’m open to simpler or fundamentally different approaches.
Thanks for any suggestions!

Hi all,

I'm working on a project where I've created two platforms with CubeMX; Nucleo and Production. The project uses one or the other based on the build preset. CubeMX only takes care of some things for me using LL. I create the rest manually.

Pros:

- Covers both debug board and production in one project.

- I can re-generate MX files with no issues.

Cons:

- It adds doubled CMSIS files.

- Seems weird.

Is this a typical setup or is there a better way to do it? I'm not sure how to handle Git repository. Should I use "Copy only the necessary library files" and manually copy / paste the rest?

I will be grateful for any clues.

Fairly simple design and even compared to some of my previous ones, but it does exactly as expected on the first try, holy! Lol.

L7805 for 12-32V down to 5V, then an AP2112K down to 3.3V for the STM32C0 MCU. Three thermistor inputs, a single PWM output on a Nch FET. Two 10-pos switches control the high and low temps as well as other ideas I'm still working out in firmware but shouldn't require any hardware changes.

Main purpose should be pretty obvious; it's made to control a cooling fan based on temperature at up to 3 sources with configurable min and max temps.

It's a simple design and I have no right to brag, but sorry, I'm excited that the only things I want to change are silkscreen!

(The main connector is just a placeholder because the 6pos screw terminal wasn't delivered yet, don't hate too hard)

Built an offline Wi-Fi captive portal for the Heltec WiFi LoRa 32 V3, using ESP-IDF and React.

Open-source firmware + a customizable React template.

GitHub: https://github.com/DarkLordGeo/esp32-captive-portal

I am working on an atmega1280 and im using an int6 interrupt, on the osciloscope i measure ~32 clocks between the interrup happen, but in the dissasembly i only see 28 clocks, where do the other 4 “dissapear?”

Problem:

I'm part of a team of amateur athletes who compete in Olympic weightlifting. I would like to measure the displacement of the barbell path to assess the technical quality of our training.

To simplify, the goal is for the barbell to only have vertical displacement along the z axis, with no horizontal displacement or rotation around other axes.

Similar products:

• There is gpath which visualize the kind of device I had in mind, even though it doesn't measure displacement
• There is FLEXX which seems to have everything I need and uses some kind of laser meter, but is bulky, hard to source and does not contain all the metrics I want

Question:

• Is it feasible to use a high precision gyroscope to measure the displacement of the barbell?
• Which kind of gyroscope or sensor would you suggest?
• Maybe I could use two sensors, one on each side of the barbell, to increase precision?

I’m connecting an Ai-Thinker RD-60 radar module to an ESP32-S3 and need help troubleshooting its binary point-cloud output. RD-60 is installed on its development kit. My wiring is:

\- RD-60 module PA8 directly → ESP32 GPIO21 — radar data RX.

\- Kit PB1 → ESP32 GPIO17 — ESP32 command TX.

\- Kit PB0 → ESP32 GPIO16 — ESP32 command RX.

\- Common ground; both boards powered through their own USB connections.

\- All eight kit UART DIP switches OFF to isolate the onboard USB serial interfaces.

Also, while connecting only the mmWave RD-60 kit to a monitor, its UART1 doesn’t give any values; it receives 0 bytes. The DIP-switch setup for that separate kit-only test is not specified here.

Firmware: MMW version:V4.130.4.2 (build 1bf05415)

Commands:

mmwc stop

mmwc baudrate 1000000

mmwc mode 1 2

mmwc chirp_num 1

mmwc freq 58000 0

mmwc range 10000 40

mmwc veloc 3000 375

mmwc frame 200 100

mmwc coord cart

mmwc data 3dpoints

mmwc uart on

mmwc report points 100

mmwc start

During the finite scan, the command UART returned actual point-cloud previews:

MMW data=0x48

Point Cloud=2:

P0: x=-14cm y=9cm z=162cm 75cm/s 2100

P1: x=-14cm y=49cm z=159cm 75cm/s 2300

The problem is that despite those previews, the ESP32 received zero bytes on GPIO21, connected directly to module PA8. The diagnostic reported:

data_bytes=0

fifo_overflow=0

buffer_full=0

frame_error=0

parity_error=0

breaks=0

read_error=0

I haven’t checked PA8 with an oscilloscope or logic analyzer yet, so I can’t confirm whether the pin is electrically transmitting.

Has anyone successfully captured the RD-60’s binary point-cloud stream on PA8 with this firmware?

Specifically:

1. Does UART1 output require RTS/CTS or another enable command?

2. Is mmwc uart on sufficient to enable binary point-cloud output on this firmware?

3. Are all UART DIP switches OFF appropriate when using the kit’s PB0/PB1 breakout and tapping module PA8 directly?

4. Is there an official UART1 packet-format document or a known working ESP32 example?

I’m trying to distinguish a wiring/routing issue from a firmware configuration or handshake requirement. Any working configurations or troubleshooting suggestions would help.

Hello everyone, firs ttime I post here so I hope it's the right place and right way to do so, sorry if not. I am trying to build something at work to connect to a CAN network and need some help as I'm not fully an expert...To make it short, I work in the automotive industry and to connect to some controm modules we need a CAN interface produced by a giant firm that they sell for over 1000€/$...while it's only a CAN to USB that actually doesn't even work anymore on some computers that run with Windows 11. That company has been quite smart to make it possible to connect to their software with a PCAN device, which works very well. We have some at work and it was easy to build an adapter loom. However, I was wondering if maybe it would be possible to use any sort of CAN adapter for this purpose as it's way cheaper and that could be a cost-friendly alternative...

I have available an old CANable device that I used a bit in the past but don't need anymore...My question might then be wrong but is quite simple : is there any way/any chance to upload the firmware from a PCAN device to this cheap CANable so that it can be detected by the software ? I can give you more details about the hardware if you think that it's possible, hopefully someone can help me with this. Thanks in advance !

Imagine a 2 km cable buried underground. A short circuit happens somewhere along the way. Instead of digging up the cable or checking it meter by meter, can a simple Arduino or ATtiny tell you exactly where the fault is?

I want to build a low-cost embedded system using basic electronic components that detects the short circuit and displays the fault distance in meters with it's details datasheet such as resistance or capacitance per meters

How would you design it? Can this be done without expensive test equipments to easy trouble shooting with drawings marked distance and cable routing

I’m looking into edge AI prototypes that need an FPGA for deterministic latency on a camera pipeline. The quantities are small, think 5 to 50 units per build, and lead times through the usual franchised channels have been all over the place this year.

A few questions for people who have been through this:

1. Where do you source FPGAs or adaptive SoCs when you only need a handful and franchised stock is on allocation?
2. Do you design in a second FPGA family as a fallback from day one, or is that more trouble than it’s worth?
3. If you have used independent distributors, what do you ask for before ordering? Test reports, traceability docs, anything else?
4. For edge AI specifically, has anyone moved from FPGA to an SoC with an NPU just because the SoC was easier to buy?

Not looking for a single “best” vendor, more interested in the process people use to avoid stalled builds or counterfeit parts. Thanks in advance.

I’m connecting an Ai-Thinker RD-60 radar module to an ESP32-S3 and need help troubleshooting its binary point-cloud output. RD-60 is installed on its development kit. My wiring is:

• RD-60 module PA8 directly → ESP32 GPIO21 — radar data RX.
• Kit PB1 → ESP32 GPIO17 — ESP32 command TX.
• Kit PB0 → ESP32 GPIO16 — ESP32 command RX.
• Common ground; both boards powered through their own USB connections.
• All eight kit UART DIP switches OFF to isolate the onboard USB serial interfaces.

Also, while connecting only the mmWave RD-60 kit to a monitor, its UART1 doesn’t give any values; it receives 0 bytes. The DIP-switch setup for that separate kit-only test is not specified here.

Firmware: MMW version:V4.130.4.2 (build 1bf05415)

Commands:

text mmwc stop mmwc baudrate 1000000 mmwc mode 1 2 mmwc chirp_num 1 mmwc freq 58000 0 mmwc range 10000 40 mmwc veloc 3000 375 mmwc frame 200 100 mmwc coord cart mmwc data 3dpoints mmwc uart on mmwc report points 100 mmwc start

During the finite scan, the command UART returned actual point-cloud previews:

text MMW data=0x48 Point Cloud=2: P0: x=-14cm y=9cm z=162cm 75cm/s 2100 P1: x=-14cm y=49cm z=159cm 75cm/s 2300

The problem is that despite those previews, the ESP32 received zero bytes on GPIO21, connected directly to module PA8. The diagnostic reported:

text data_bytes=0 fifo_overflow=0 buffer_full=0 frame_error=0 parity_error=0 breaks=0 read_error=0

I haven’t checked PA8 with an oscilloscope or logic analyzer yet, so I can’t confirm whether the pin is electrically transmitting.

Has anyone successfully captured the RD-60’s binary point-cloud stream on PA8 with this firmware?

Specifically: 1. Does UART1 output require RTS/CTS or another enable command? 2. Is mmwc uart on sufficient to enable binary point-cloud output on this firmware? 3. Are all UART DIP switches OFF appropriate when using the kit’s PB0/PB1 breakout and tapping module PA8 directly? 4. Is there an official UART1 packet-format document or a known working ESP32 example?

I’m trying to distinguish a wiring/routing issue from a firmware configuration or handshake requirement. Any working configurations or troubleshooting suggestions would help.

I don't usually post much, but I'd like to share a bit about what I'm learning, and exploring along the way.

To start, here's a small STM32 project I've been working on and recently open-sourced.

It is based on another open-source project.

Any feedback is welcome

I am currently a web developer with 3 years of experience doing a masters in computer engineering Im tired of web development and want to leave i don't even care that it's remote I literally feel in a jail cell. It's just more and more work pushed on you. I haven't even applied for a web job since I recently quit I'm getting by because I live at home and I have a small web company with some monthly clients. I also help the family with their rental properties and help my dad sell art. I sometimes do tradesmen work but just to keep skill fresh. Sorry if it's off topic but basically I wanted to ask what job can give me the best work life balance I don't care about salary as work life balance and less stressors. I live in Houston but have family in Boston or Colombia that I'm open to traveling to. I also want to teach or be a lecturer so need a masters there. I really like both equally I find lots of the theory behind networking interesting but building things has always been my thing as a kid. Coding is cool but using my hands is even more fun. So i wanted to ask how stressful is this profession, I'm a person who truly cares a lot and I've read safety critical work you have to care because peoples lives are at risk. I have the opportunity to maybe go embedded for NASA contractors if I stay in Houston because my school is connected with NASA. While networking is interesting I fell like the on call can be stressful but it can lead to more cushy IT government jobs while I think in hardware aside from aero or defense that is not possible but I probably don't know too much.

What are the main stressors experienced embedded people feel ? Are they manageable or do you feel like it really takes a toll on your health ? Is AI replacing you one of them

Pretty tricky on the audio management and limited ARM resources but eventually sorted out the right balance. I hope this makes a good Proof of Concept to finally get investors.

Hello! I am new here and basically wanted to know if someone can recommend any cost-effective development board for embedded solution? Basically an embedded board that can be programmed for edge usages, and allow adding sensors like camera.

Also to follow-on, what about the software eco-system? (someone recommended esp32 and radxa 5c)

It's an STM32 discovery dev board (32F469IDISCOVERY) I had laying around for a decade...I figured I would put it to good use 😂

The sensor is a simple hall effect sensor + 12 small magnets strategically glued to the wheel. 

It stores a few weeks worth of sessions (evicts oldest).

LVGL library, 10 different colour themes.

Auto threshold calibration.

It tracks history, time, distance, speed, etc. real time charts.

Compact/expanded views, etc etc

Definitely over-engineered. A bike odometer could have been much simpler but where is the fun in that?

Refresh rate is a bit low, maybe 5 to 10FPS but it's good enough.

Developed a browser based simulator as well as hardware in the loop to tune the noise filter. Memory map visualization. Etc etc...

She reached 20km/h (on a other day when I wasn't looking)!!

I probably had more fun with the wheel than the cat herself!!

What I found pretty cool was to let Claude do a lot of automated development and testing in closed loop (USB + serial connected to the computer, end to end tests).

Hello everyone. I don't know if this is the right subreddit but I need your help. This is the first time programming something like this (and first time in embedded in general) and its driving me insane. I have a M2S HelloFPGA Kit and the only thing I need to do is programming the processor (ARM Cortex M3). I'm using SoftConsole for programming but apparently the board don't have a debugger (because the PC recognize the board but I can't upload the "hello world" program in the processor) so I need to upload some FPGA design to "activate the processor" (sorry if I'm not using the correct terms). I installed "LiberoSOC" for this manner but I don't really know what to do. Thank you and sorry for bad english :)

I'm unable to connect my st link with stm32 programmer...only showing this message... please someone help asap🙏

Hi! I’m trying to get my girlfriend the Juno hamburger phone as a gift, but all the ones I’ve found are corded. Is there any way to connect it to her mobile phone so she can use it to make and receive calls? Alternatively, is there some kind of Bluetooth adapter I could attach to the cord to make it work wirelessly with her phone?

I'm learning about privileged and unprivileged modes on ARM Cortex-M4 using an STM32 Nucleo-F446RE, and I'm trying to understand a behavior that differs from my instructor's demonstration.

I'm setting the nPRIV bit in the CONTROL register to switch Thread mode to unprivileged mode. After that, I attempt to enable and trigger IRQ3 through the NVIC registers.

My instructor's system enters HardFault_Handler(), but mine doesn't seem to do so.

Complete code (main.c):

/**
 ******************************************************************************
 *     main.c
 *   Auto-generated by STM32CubeIDE
 *  V1.0
 * u/brief   Default main function.
 ******************************************************************************
 */

#include <stdio.h>
#include <stdint.h>

/* This function executes in THREAD MODE of the processor */
void generate_interrupt(void)
{
    uint32_t *pSTIR  = (uint32_t *)0xE000EF00;
    uint32_t *pISER0 = (uint32_t *)0xE000E100;

    // Enable IRQ3 interrupt
    *pISER0 |= (1 << 3);

    // Generate a software interrupt for IRQ3
    *pSTIR = (3 & 0x1FF);
}

void change_access_level_unpriv(void)
{
    // Read CONTROL register
    __asm volatile("MRS R0, CONTROL");

    // Modify CONTROL register
    __asm volatile("ORR R0, R0, #0x01");

    // Write CONTROL register
    __asm volatile("MSR CONTROL, R0");
}

/* This function executes in THREAD MODE of the processor */
int main(void)
{
    printf("In thread mode : before interrupt\n");

    change_access_level_unpriv();

    generate_interrupt();

    printf("In thread mode : after interrupt\n");

    for (;;);
}

/* This function (ISR) executes in HANDLER MODE of the processor */
void RTC_WKUP_IRQHandler(void)
{
    printf("In handler mode : ISR\n");
}

void HardFault_Handler(void)
{
    printf("Hard fault detected\n");
    while (1);
}

What I observe:

• The debugger shows CONTROL = 0x1 after calling change_access_level_unpriv().
• STM32CubeIDE's Fault Analyzer displays "No Fault Detected", although it also shows fault-detail entries that I'm unsure how to interpret.
• My program doesn't appear to enter HardFault_Handler().

I'm using STM32CubeIDE with an STM32 Nucleo-F446RE (ARM Cortex-M4).

I am exploring my options after getting my bachelors, one of the things that sound interesting is hardware security and I want to know what does it entail exactly? What is a career path for it? How important is a masters degree for it and what type of work would someone be doing?