hackshopStart a build

The hardware field notebook

What people are actually hacking right now.

Source-linked projects for reclaiming displays, speakers, appliances and abandoned hubs. Every entry says what was really tested, which exact model it applies to, and where the dangerous assumptions begin.

46 curated entriesDocumented buildsAuthor demosAnalysis methodsCheap display designs

Read the evidence, not the vibe

A demo is useful inspiration. It is not a compatibility promise. “Documented” means there is an inspectable implementation or guide; only “independently reproduced” cites a separate reproduction.

Reproduced
Independent build cited
Documented
Inspectable repo or guide
Demo
Author-reported result
Method
Saved evidence or analysis tool

39 entries

Documented builds

Projects with a public implementation or guide. Exact targets and recovery notes still outrank popularity, stars or a polished video.

Documented build

Pair an Apple Watch Ultra 2 with Android

Apple Watch Ultra 2

Apple Watch Companion reconstructs native Bluetooth, pairing, activation and IDS protocols. The author's hardware journal records optical camera pairing, activation, a visible watch face and encrypted reconnect on the tested Watch and Android phone.

OutcomeAn experimental Android companion with native battery observations, selected settings and partial notification and face-management support on one tested device combination.

Apple Watch Companion repositoryHardware pairing and activation journalRelease support and missing build inputsMd Ismail Sojal original demonstrationShantanu Goel repost
Documented build

Replace Alexa with Muse on an Echo Show 5

Amazon Echo Show 5 (2nd generation)

Hey Muse builds on TECHO5 to pair an unlocked Echo Show with Meta's Muse app, run a local Hey Muse wake word and speak answers through a built-in or cloud voice.

OutcomeA repurposed smart display that boots a small Linux image and acts as a Muse voice-and-screen body without Alexa or Amazon cloud services.

Hey Muse repositoryHey Muse setup guideAuthor demonstration
Documented build

Use a Roomba 692 through its local MQTT API

iRobot Roomba 692

roomba-telemetry uses the reverse-engineered local MQTT/TLS interface for live state, schedules, preferences and mission commands, with one physically verified exact model.

OutcomeLocal vacuum telemetry and control with a pairing-first credential path and a documented cloud-login fallback.

Roomba Telemetry
Documented build

Control firmware-qualified Orbit B-Hyve timers over BLE

Orbit B-Hyve hose timers and XD controllers

orbit-bhyve-ble obtains per-device AES keys once, then uses local BLE with a hardware-and-firmware compatibility matrix rather than claiming blanket brand support.

OutcomeLocal watering status and actuation for six tested model/firmware combinations after one cloud-assisted key retrieval.

Orbit B-Hyve BLE
Documented build

Run LG ThinQ appliances against a local cloud emulator

LG ThinQ air conditioners

rethink emulates LG ThinQ's cloud locally and translates appliance traffic to MQTT/Home Assistant, with optional bridge mode for retaining the official app.

OutcomeLocal status and control for specific documented ThinQ models without modifying appliance firmware.

rethink repository
Documented build

Speak Haier's encrypted local AC protocol

Haier split air conditioner

haismart-local implements the encrypted TCP/56800 protocol and records a hardware-confirmed combination down to product code, Wi-Fi module and firmware.

OutcomeLocal power, mode, setpoint, fan, vane, self-clean and energy readings after a one-time cloud login retrieves the device key.

haismart-local repository
Documented build

Replace a Rainy 75 Pro keyboard's firmware with ZMK

Wobkey Rainy 75 Pro

A hardware-verified ZMK port covers the keyboard's USB, BLE, 83-key matrix and RGB functions while documenting the stock image and hardware recovery route.

OutcomeAn open keyboard firmware replacing the vendor image on verified ANSI and ISO boards.

Rainy75 ZMK repository
Documented build

Replace the runtime on an Ulanzi TC002 Pixbar

Ulanzi Pixbar Smart Pixel Clock II

tc002-customisation documents stock root ADB and HTTP behavior, a reversible /tmp runtime and an optional replacement runtime written only after device fingerprinting and backup verification.

OutcomeA locally controlled 52x16 pixel display with an incremental path from reversible experiment to persistent replacement.

TC002 customisation repositoryTC002 install guide
Documented build

Use AirPods features without Apple's software stack

Apple AirPods Pro 2 USB-C

LibrePods reverse-engineers the AirPods protocol to expose noise modes, battery and ear detection on Android and Linux without changing earbud firmware.

OutcomeA cross-platform protocol client for core AirPods controls and telemetry outside Apple's ecosystem.

LibrePods repository
Documented build

Add an open local stack to an Anycubic Kobra 3

Anycubic Kobra 3 / Combo

Rinkhals retains the stock printer UI and features while adding SSH, Mainsail, Fluidd, Moonraker and installable local apps.

OutcomeA locally extensible 3D printer that keeps the vendor interface while exposing the open Klipper ecosystem.

Rinkhals repository
Documented build

Proxy a LifeBreath HRV control bus with ESPHome

LifeBreath heat-recovery ventilator

An ESP32-S3 sits as a protocol-aware proxy on the proprietary three-wire open-collector bus, preserving the original wall panel and timers while adding local Home Assistant control.

OutcomeBidirectional local control and telemetry without discarding the appliance's original controls.

LifeBreath HRV ESPHome
Independently reproduced

Root a $50 BIUFRAME into a home dashboard

BIUFRAME 10.1-inch smart photo frame

Wes Bos documented a guarded ADB-and-SuperSU workflow that identifies the board, verifies a full backup, removes vendor/FOTA apps, updates the browser stack and turns the frame into a USB-powered kiosk.

OutcomeA rooted touch display running a modern web dashboard. Independent photos and videos from Philip Ideson and Deepak show the broader frame-dashboard idea reproduced, although their exact boards are undisclosed.

Wes Bos articlePhoto Frame Dashboard repositoryBIUFRAME setup guideOriginal Wes Bos postPhilip Ideson family-hub replicationDeepak build video
Documented build

Control a Charnwood stove locally with OpenWood

Charnwood Aire 300 wood stove

OpenWood reverse-engineers the Charnwood-E Android app and verifies BLE pairing/control, Wi-Fi polling and 21 Home Assistant entities against a live stove.

OutcomeLocal MQTT/Home Assistant integration for one physically tested wood stove while its onboard controls remain authoritative.

OpenWood repository
Documented build

Reclaim the Allwinner photo frame hiding under the same listing

AiMOR / BIUFRAME Allwinner photo frame

A separate guide covers the Allwinner A33 PF1007L now commonly shipped under the BIUFRAME listing, with identity-dependent paths through stock ADB, an AiMOR-mediated temporary root, FEL or a guarded boot patch.

OutcomeA local kiosk or dashboard on the Allwinner frame without applying the incompatible Rockchip instructions.

PF1007L start pagePhoto-frame device indexPhoto Frame Dashboard repository
Documented build

Replace Roborock cloud services with a local server

Roborock S8

local_roborock_server recreates the vacuum's HTTPS and MQTT cloud endpoints with DNS and certificate onboarding, without rooting or writing custom firmware.

OutcomeA Roborock S8 controlled through a fully local server, with an exact firmware/certificate combination recorded in the compatibility matrix.

Local Roborock ServerTested vacuums matrix
Documented build

Reclaim a Lenovo Smart Clock 2 without permanent flashing

Lenovo Smart Clock 2

smartclock2tool uses a runtime-only kernel exploit for temporary root, SSH and Wi-Fi ADB; Helios adds a local Home Assistant dashboard, wake word and Music Assistant interface.

OutcomeA local smart display that returns to stock after a power cycle and avoids bootloader or partition writes.

smartclock2toolHelios dashboard
Documented build

Patch a Xiaomi smart speaker for local audio services

Xiaomi XiaoAI Speaker Pro

xiaoai-patch modifies the inactive root filesystem to add MPD, Snapcast, Shairport, Squeezelite, Whisper and Home Assistant integrations.

OutcomeA vendor smart speaker repurposed as a flexible local network audio endpoint.

xiaoai-patch repository
Documented build

Read and guard-write a Micro-Air EasyStart over BLE

Micro-Air EasyStart Flex

microair-bt derives the OEM BLE protocol and exposes live data plus a guarded, hardware-verified relearn command through an ESPHome proxy.

OutcomeLocal compressor soft-starter telemetry and a narrow verified configuration write for one exact model.

microair-bt repository
Documented build

Run a Govee ice maker without its cloud

Govee portable ice maker

The Home Assistant integration implements the exact model's 20-byte BLE protocol, reverse-engineered from the Android app, including power, work mode and device-only alarms.

OutcomeCloud-free control plus low-water and tray-full state that the stock cloud path does not need to mediate.

Govee H7172 BLE integration
Documented build

Replace QuietCool attic-fan firmware with ESPHome

QuietCool Smart Attic Fan Control

quietcool-esphome-native installs over the controller's BLE OTA and preserves fan control, Smart Mode, timers, buttons, LEDs and OEM BLE app control with stock-restore and recovery paths.

OutcomeLocal Home Assistant control of an exact attic-fan controller with end-to-end hardware testing and layered recovery.

QuietCool ESPHome Native
Documented build

Turn three Amazon speakers into local Assist satellites

Amazon Echo Dot / Echo 2

Echo Dot Assist preserves Amazon's microphone and wake-word stack while replacing Alexa with a local Home Assistant ESPHome/Wyoming daemon on three tightly pinned hardware and firmware combinations.

OutcomeLocal wake-word, voice capture and Home Assistant Assist on otherwise cloud-bound Echo speakers.

Echo Dot Assist repository
Documented build

Control a Tapo P110 with no cloud account

TP-Link Tapo P110 smart plug

tapo-local reimplements the app's SPAKE2+ handshake and AES-128-CCM protocol for local Wi-Fi and BLE relay, metering, protection and history access.

OutcomeCloud-free smart-plug control and energy data without flashing the sealed device.

Tapo Local repository
Documented build

Take a CM4 Vestaboard fully offline

Vestaboard split-flap display

vestaboard-offline documents the board's Yocto/CM4 stack and RS485 flap protocol, then replaces its vendor-cloud dependency with a local controller.

OutcomeA physical split-flap display controlled locally after root/SSH access and vendor-cloud removal.

Vestaboard Offline
Documented build

Reclaim an abandoned Sengled hub as a Zigbee coordinator

Sengled Element Hub

sengled-hub-reclaim converts first- and second-generation hubs into local EZSP v7 Zigbee coordinators with a dry-run gate, complete backup and retained recovery bank.

OutcomeA cloud-independent Zigbee coordinator built from a discontinued hub.

Sengled Hub Reclaim
Documented build

Control Hue bulbs and store schedules over Bluetooth

Philips Hue White and Color Ambiance bulb

OpenHue is a native macOS BLE controller with published GATT protocol notes. Its author decoded on-bulb alarm storage and verified schedule creation on LCA003 firmware 1.163.1.

OutcomeLocal power, brightness, color, scenes and timers, including stored schedules that can fire while the Mac is absent.

OpenHue repository and protocolPinned LCA003 verification
Documented build

Replace an ACiQ mini-split's Wi-Fi module with ESPHome

ACiQ mini-split

The project decodes the stock module's 115200 8N1 UART bus and provides an ESPHome takeover with hardware-proven commands, ACKs, heartbeat and a safer receive-only listener mode.

OutcomeCloud-free mini-split telemetry and control through an ESP32 connected to the exact CN-16 module bus.

ACiQ mini-split protocol
Documented build

Install open firmware on a GeekMagic pixel display

GeekMagic smart display

GeekMagic Open Firmware replaces the stock image over OTA or USB-TTL and includes a rescue access point after repeated boot failures.

OutcomeA fully open small pixel display with local customization and a documented recovery path.

GeekMagic Open Firmware
Documented build

Build a 7-inch calendar or room panel for $36.99

Waveshare ESP32-S3-Touch-LCD-7

Official Arduino/LVGL examples and factory test firmware provide a repeatable starting point for a large native touchscreen layout.

OutcomeAn affordable large-screen renderer for calendars, room status and remote AI interfaces.

Manufacturer implementationLVGL setupFactory firmware and reflashing
Documented build

Build a native touchscreen UI on a Cheap Yellow Display

Sunton Cheap Yellow Display

The community CYD project publishes board-specific TFT/touch configuration, USB web-flash examples and troubleshooting for the exact resistive-touch board.

OutcomeA low-cost native color touchscreen for a small agenda, room controller or concise remote AI interface.

CYD community implementationsExact board setupRecovery troubleshooting
Documented build

Build a tiny color panel on a $9 T-Display-S3

LILYGO T-Display-S3

Manufacturer Arduino, PlatformIO and ESP-IDF examples, factory firmware and BOOT/RST recovery make this inexpensive screen a documented native text-and-image client.

OutcomeA small programmable Wi-Fi display for one appointment, countdown, status or remote AI response.

T-Display-S3 code and factory imageManufacturer setup guideDated seller variants
Documented build

Build calendar and AI lighting with the Hue Bridge API

Philips Hue Bridge V2 and paired lights

Hue's official local REST interface provides bridge discovery, physical link-button authorization, state reads and light commands. Home Assistant adds local push updates on V2 bridges.

OutcomeA straightforward local integration for existing Hue owners, with per-light capabilities discovered from the bridge.

Hue official local API tutorialHome Assistant Hue local push integration
Documented build

Control Hue bulbs through Zigbee2MQTT

Philips Hue E26/E27 bulbs

Zigbee2MQTT documents direct coordinator support for exact Hue bulbs, including brightness, color temperature, applicable color controls, power-on behavior and Hue-specific effects.

OutcomeLocal MQTT control from calendars, AI agents, information panels or Home Assistant using a supported Zigbee coordinator.

White and Color exact supportWhite Ambiance exact support
Documented build

Drive a Hue bulb directly from Python

Philips Hue White and Color Ambiance E27 1100-lumen bulb

MIT-licensed HueBLE uses Bleak to control Hue's BLE GATT interface, exposing power, brightness, color temperature, color, effects and transitions without a Hue Bridge.

OutcomeA local programmable light for timers, calendar reminders and dashboard-linked state, with tested-model and live-state caveats documented.

HueBLE implementationPairing, state and tested-model docsExact Hue converter mapping
Documented build

Make a low-power 4.7-inch e-paper calendar

LILYGO T5 ePaper S3

The manufacturer's ESP32-S3 branch supplies display examples and USB download-mode recovery for this 16 MB flash/8 MB PSRAM e-paper board.

OutcomeA grayscale display for periodic calendar, weather, chores or generated briefing images.

ESP32-S3 display implementationSeller hardware variants
Documented build

Reclaim an electronic shelf label as a room status display

SOLUM electronic shelf label

OpenEPaperLink's exact-model guide documents ZBS pin programming with AP-Flasher and an access-point workflow for image updates on reclaimed shelf labels.

OutcomeA small low-power calendar or status label using an OpenEPaperLink AP and host-rendered images, with current sourcing price still unknown.

Exact ST-GR29000 guideOpenEPaperLink
Documented build

Reflash a Ulanzi pixel clock into an information ticker

Ulanzi TC001 pixel clock

AWTRIX NG adds local HTTP/MQTT interfaces and Berry scripts to the TC001, with browser/esptool installation and original-firmware backup instructions.

OutcomeA local notification, countdown and ambient status ticker on an inexpensive ready-made pixel clock.

AWTRIX NGInstall and original firmware backup
Documented build

Turn an original NSPanel into a local room controller

SONOFF NSPanel original

The Home Assistant blueprint project documents ESPHome flashing, region-specific Nextion TFT upload and version matching for the original wall panel.

OutcomeLocal lights, climate, scene and room-status controls on a wall-mounted touchscreen.

NSPanel Home Assistant BlueprintInstall guideTFT recovery guide
Documented build

Use a $29.90 magnetic e-paper status tile

M5Stack CoreInk

CoreInk combines a finished magnetic case, RTC and 390 mAh battery with supported M5Unified/M5GFX libraries and factory Easyloader recovery.

OutcomeA compact battery information tile for one appointment, task, room label or short AI summary.

Official guide and factory restoreM5UnifiedM5GFX
Documented build

Use a $59 Android tablet as a full browser panel

onn 7-inch tablet (2024)

The stock Android tablet can host a browser kiosk through normal app installation. Fully Kiosk documents Android Go restrictions, so exact-unit testing remains necessary.

OutcomeA full HTML calendar, dashboard or remote AI chat interface on stock Android without a verified root modification.

Exact seller listingFully Kiosk Android support and limitations

03 entries

Author demos

Interesting interfaces shown against real hardware, but without enough model, protocol or recovery detail to hand to another builder yet.

Author demo

Map an apartment's reverse-engineered devices into a 3D menu

Mixed apartment lamps and air conditioners

0xProbability demonstrated a macOS menu-bar model of an apartment where clicking rendered lamps and ACs controls the physical devices.

OutcomeA spatial whole-home interface shown controlling multiple real-world devices from one 3D view.

Apartment 3D-menu demonstration
Author demo

Expose a Blue Star AC through MCP

Blue Star air conditioner (exact model undisclosed)

A social demonstration shows a reverse-engineered Blue Star air conditioner exposed through an MCP control surface.

OutcomeAn agent-facing appliance controller demonstrated against the author's AC.

Blue Star AC MCP demonstration
Author demo

Reverse-engineer an AC into a menu-bar and glasses UI

DELLA air conditioner (exact model undisclosed)

Ilter Canberk demonstrated an AC status-bar controller, then ported the same interface to Spectacles with an appliance-anchored Lens Studio overlay.

OutcomeA compact desktop controller and an AR control surface shown operating the author's air conditioner.

AC menu-bar demonstrationSpectacles follow-up

04 entries

Analysis methods

Saved firmware and signal evidence you can inspect reproducibly. These records deliberately do not claim physical acquisition, flashing or runtime proof.

Analysis method

Analyze saved firmware and signal captures with REA

REA reverse-engineering workbench

REA combines evidence capture, firmware extraction/signature workflows and saved signal-recording analysis. Its public showcase is software-only; the hardware-bearing evidence lives in its experiment corpus.

OutcomeA repeatable research method for inspecting files and preserving evidence without overstating live-device validation.

REA homepageREA showcaseREA source at inspected commit
Analysis method

Decode a Wii Nunchuk from a saved I2C capture

Nintendo Wii Nunchuk controller

REA and sigrok decode the extension controller's initialization, register selection and three six-byte sensor/button reads from a pinned logic capture.

OutcomeA reproducible seven-transaction I2C analysis that can guide controller repurposing without claiming the capture's unknown retail revision.

REA hardware corpusREA signal workflowsigrok capture collectionWiiBrew protocol notes
Analysis method

Recover inverted UART through a MAX3232E capture

Maxim / Analog Devices MAX3232E transceiver

REA validates a pinned sigrok capture and shows why DOUT1 inversion is required to recover five Hello world frames instead of plausible but wrong bytes.

OutcomeA reusable example of polarity-aware UART decoding across an RS-232 transceiver.

REA hardware corpusREA signal workflowAnalog Devices MAX3232E
Analysis method

Inspect an Archer C7 OpenWrt image with REA

TP-Link Archer C7 v5

REA pins and statically scans the exact OpenWrt sysupgrade artifact with firmware-region tooling, recording its digest and workflow without claiming a physical flash.

OutcomeA reproducible firmware-analysis example for signatures and regions, linked to Hackshop's existing Archer C7 device and flash playbook.

REA pinned corpusOpenWrt target index
Checked October 14, 2026. Sources are linked per entry. For agent access, use the MCP tool find_reverse_engineering_examples or read hackshop://reverse-engineering/examples.