Digital Ally ThermoVu DTM-600 / Uniview LAPI Security Research Release

I have some very backlogged projects I’ve decided to just release to get them out of my backlog. This one is related to the Digital Ally ThermoVu DTM-600, which is a Uniview/OEM OET-213H-NB-style facial recognition and thermal access-control device. This release is the majority of my notes, tools, findings, and research artifacts from looking at … Continue reading Digital Ally ThermoVu DTM-600 / Uniview LAPI Security Research Release →

AutoPro and 3rd Party Carplay/Android Auto Dongle Security Research

I have some very backlogged projects I've decided to just release to get them out of my backlog. The first one is related to aftermarket Apple CarPlay and Android Auto dongles. This release is the majority of my notes, tools, findings, and research artifacts from looking at the Mayton/AutoPro-style dongle ecosystem. It includes documentation, test … Continue reading AutoPro and 3rd Party Carplay/Android Auto Dongle Security Research →

AutoProber – Automated PCB Probing for hardware hackers

AutoProber is the hardware hacker's flying probe automation stack for giving your agent everything it needs to go from "there's a new target on the plate" to probing individual pins.

Button Presses to Wireless RCE: Shell on Flock Safety’s License Plate Cameras Over Wi-Fi

A combination of reused default passwords, hidden triggers, and completely unauthenticated APIs results in reliable wireless RCE, data disclosure, and device control in the field on Flock Safety's License Plate Readers.

Fly-By – Device 2: The Falcon/Sparrow – Gated Wireless RCE, Camera Feed, DoS, Information Disclosure and More

Covering the next batch of disclosures in regards to my Flock Safety security research.

Trap Shooter – Flock Safety Sniffer & Alarm

Custom firmware for the M5NanoC6 (ESP32-C6) that sniffs and then alerts you of nearby Flock Safety devices. Will be integrated into a exploit tool releasing on 09/27/25 for Flock Safety devices!

Unbricking and Flashing the Yardstick One

Bricked your Yardstick One? This step-by-step guide shows how to recover it using its cousin, the GreatFET, by erasing, flashing, and verifying full Sub 1 GHz sniffer functionality.

Using a Nexus 6P and QCSuper to Sniff LTE.

Step by step instructions on how to setup and configure a Nexus 6P to sniff portions of the LTE wireless stack.

Reverse Engineering the Little Tikes Dream Machine Projector – Part 1

Part 1 of my journey into reverse engineering the little tikes dream machine projector.

Unbricking and Reflashing the Ubertooth One Clones

Purchased a Ubertooth One Clone from Amazon or Aliexpress that doesn't seem to be working in 2025? Bricked your Ubertooth One? This step-by-step guide shows how to recover it using UART flashing, fix common issues, and verify full Bluetooth sniffer functionality.