Kim Salmi

Developer & CTO

← Back
·AI·Claude·Reverse engineering·Tagsu

Giving AI eyes to reverse engineer hardware

The kids found some old Tagsu badges and wanted something else on the screens. Tagsu is a wearable LCD name badge that Jari Tulilahti designed at Rakettitiede in 2015. You update it by playing audio into its headphone jack, using his own audio modem for AVR. You used to be able to create the audio files with Tagsu's editor at tagsu.io/edit, but that is now offline.

claude ~/tagsu34 prompts
  1. Fri 23 Oct 2026
  2. do you have the tagsu editor, can i run it manually?
  3. search on internet if tagsu.io/edit is somewhere avialable?
  4. is here anythign? [pasted the original editor's HTML from the Wayback Machine]
  5. [photo of the badge] any clues?
  6. could it corrupt the chip if i send random sounds?
  7. [photo of the printed manual]
  8. 18 messages: relayed the badge's screen while Claude played test uploads: LOAD"*",8,1, then ?LOAD ERROR / RUN, then a restart into Tagsu v1.12, over and over
  9. look at the webcam.

So let's give Claude (Opus 5.5 in Claude Code) some eyes. With the webcam pointed at the badge it could see the real world and work on its own. For the next hour it kept sending different data and watching if the badge did anything different.

The board has PRG pads for programming the chip directly, so reading the firmware out with an AVR programmer would have been the easy path, but I did not have the hardware for it.

claude ~/tagsucontinued
  1. Fri 23 Oct 2026
  2. testing 256 first bytes on camera…
  3. [5 photos of a Tagsu board]
  4. Isint there usually some signal start/timing bytes in the beginning of similar syncs?
  5. I think there is not any random byte in the middle, so focus on the end/the new ideas
  6. testing 51 checksum layouts…
  7. Also read the hackaday post with comments. Check for other clues in jari blog? Look and the indiego from wayback machine?
  8. testing 2 KB page uploads…
  9. testing 141 bit orders…
  10. Sorry but that link is dead [4 screenshots of the Tagsu Facebook page, one about the firmware update]
  11. [Google Drive link]
  12. still ?LOAD ERROR
  13. This one has some audio of an actual upload maybe: https://youtu.be/3ZH9MMPjONw

Using the audio from the YouTube video, Claude was able to reverse engineer the format of the signal and write something that the board accepted:

Of course, if I had checked my email a bit earlier, I would have seen that Jari had given me access to the firmware, which would have helped a lot in Claude's guesswork.

Without the video Claude got surprisingly close. In about 450 attempts it got the modem right, worked out that the screens live in 2 KB of flash written in 64-byte pages, and even picked the right family of checksums, the CRC routines in avr-libc. But it tried the 16-bit CRCs and the 8-bit iButton CRC and left out _crc8_ccitt_update, the 8-bit CRC the badge actually uses. It also guessed blocks of 10 or 16 bytes, when a real block is 18: a block number, 16 bytes of data and the checksum. A blind search only works when every piece is right at the same time, so the badge kept answering ?LOAD ERROR. With more time it would probably have got there at some point.

In the end the reverse engineered spec is:

Part Spec
Signal Square wave at 44.1 kHz, each half-wave is one symbol: 3 samples = bit 0, 5 samples = bit 1, 17 samples = sync. Bytes go least significant bit first
Start 0.5 s of sync pulses
Block [block number][16 data bytes][CRC-8, polynomial 0x07], then 38 syncs (88 after the last block)
Blocks 128 blocks numbered 1 to 128, in order. The badge writes block n to flash at 0x17F0 + 16n
Screens 42 screens of 2 × 16 characters, 32 bytes each
Screen list 6 bytes per screen: text number, delay in seconds, in effect, out effect, logo number, logo kind (0x40 built-in, 0x80 custom). FF ends the list. Bit 7 of the text number = double height, bit 7 of an effect = blink
Effects 0 none, 1 random, 2–3 walls, 4–5 scroll, 6–7 curtains, 8 Invaders, 16 rockets, 32–36 Pac, Boulder, Miner, Archer, Aeroplane
Custom logos 10 logos of 15 × 16 pixels, 32 bytes each, shown with custom characters 0–2 and 4–6
Character set Not the usual HD44780 table: European letters at 0x80–0x9F (ä 0x84, ö 0x94, å 0x86), katakana at 0xA0–0xDF

Here is a reverse engineered editor for editing your Tagsu:

Tagsu editorWrite screens and send them to your badgeOpen editor

Links

The editor is an unofficial compatibility fix because the original site is gone. Not affiliated with Rakettitiede.

Related posts