Reverse engineering of proprietary firmware and formats

When the vendor left no documentation, we recover it. We dump the flight controller image over DFU, identify the base and compare it against the official build by every parameter and by code: on one purchased aircraft 65 of 681 parameters were missing, all of them disabled hardware rather than removed protection; on another, a non-standard frequency indicator in the OSD turned out to be a second dBm element bound to the active CRSF antenna, and the advertised “SmartAudio” was in fact Tramp. We open vendor ground-station protocols and replace them with our own software. We take apart binary aviation data formats: obstacle, navigation database and chart formats for Garmin receivers recovered to byte-exact decoders with write-back. We hold a corpus of several thousand DJI firmware images and know how they are distributed, signed and unpacked; we rebuild DJI ecosystem applications from decompilation to a byte-for-byte match with the original and accept them on a live controller. Starlink terminals have been taken apart on our own units down to the boot chain and modem firmware: the eMMC layout, A/B slot selection and rollback in U-Boot, the antenna’s embedded processor and its firmware, the inter-process bus, the terminal’s gRPC interface; individual firmware units run in isolated emulation to confirm static findings. The public analysis corpus is more than a hundred documents cross-checked against open publications from 2021–2025.

One rule: reverse engineering is done for interoperability and on the customer’s own equipment; we do not defeat third-party protections for anyone.

Write to us Describe the task in two lines — we reply to the point.