---
title: Giving AI eyes to reverse engineer hardware
date: 2026-10-24
keywords: AI, Claude, Reverse engineering, Tagsu
embed: /tagsu/embed/index.html
embedTitle: The Tagsu badge in 3D
---
The kids found some old Tagsu badges and wanted something else on the screens. Tagsu is a wearable LCD name badge that Jari Tulilahti designed at [Rakettitiede](https://rakettitiede.com/) in 2015. You update it by playing audio into its headphone jack, using his own [audio modem for AVR](https://firebay.pelaaja.info/embedded/12kbps-simple-audio-data-transfer-for-avr/). You used to be able to create the audio files with Tagsu's editor at tagsu.io/edit, but that is now offline.
claude ~/tagsu34 prompts
Fri 23 Oct 2026
›do you have the tagsu editor, can i run it manually?
›search on internet if tagsu.io/edit is somewhere avialable?
›is here anythign? [pasted the original editor's HTML from the Wayback Machine]
›[photo of the badge] any clues?
›could it corrupt the chip if i send random sounds?
›[photo of the printed manual]
⋯18 messages: relayed the badge's screen while Claude played test uploads: LOAD"*",8,1, then ?LOAD ERROR / RUN, then a restart into Tagsu v1.12, over and over
›look at the webcam.
So let's give Claude (Opus 5.5 in Claude Code) some eyes. With the webcam pointed at the badge it could see the real world and work on its own. For the next hour it kept sending different data and watching if the badge did anything different.
The board has PRG pads for programming the chip directly, so reading the firmware out with an AVR programmer would have been the easy path, but I did not have the hardware for it.
claude ~/tagsucontinued
Fri 23 Oct 2026
⏺testing 256 first bytes on camera…
›[5 photos of a Tagsu board]
›Isint there usually some signal start/timing bytes in the beginning of similar syncs?
›I think there is not any random byte in the middle, so focus on the end/the new ideas
⏺testing 51 checksum layouts…
›Also read the hackaday post with comments. Check for other clues in jari blog? Look and the indiego from wayback machine?
⏺testing 2 KB page uploads…
⏺testing 141 bit orders…
›Sorry but that link is dead [4 screenshots of the Tagsu Facebook page, one about the firmware update]
›[Google Drive link]
⏺still ?LOAD ERROR
›This one has some audio of an actual upload maybe: https://youtu.be/3ZH9MMPjONw
›
Using the audio from the YouTube video, Claude was able to reverse engineer the format of the signal and write something that the board accepted:
Of course, if I had checked my email a bit earlier, I would have seen that Jari had given me access to the firmware, which would have helped a lot in Claude's guesswork.
Without the video Claude got surprisingly close. In about 450 attempts it got the modem right, worked out that the screens live in 2 KB of flash written in 64-byte pages, and even picked the right family of checksums, the CRC routines in avr-libc. But it tried the 16-bit CRCs and the 8-bit iButton CRC and left out `_crc8_ccitt_update`, the 8-bit CRC the badge actually uses. It also guessed blocks of 10 or 16 bytes, when a real block is 18: a block number, 16 bytes of data and the checksum. A blind search only works when every piece is right at the same time, so the badge kept answering ?LOAD ERROR. With more time it would probably have got there at some point.
In the end the reverse engineered spec is:
| Part | Spec |
|---|---|
| Signal | Square wave at 44.1 kHz, each half-wave is one symbol: 3 samples = bit 0, 5 samples = bit 1, 17 samples = sync. Bytes go least significant bit first |
| Start | 0.5 s of sync pulses |
| Block | `[block number][16 data bytes][CRC-8, polynomial 0x07]`, then 38 syncs (88 after the last block) |
| Blocks | 128 blocks numbered 1 to 128, in order. The badge writes block n to flash at `0x17F0 + 16n` |
| Screens | 42 screens of 2 × 16 characters, 32 bytes each |
| Screen list | 6 bytes per screen: text number, delay in seconds, in effect, out effect, logo number, logo kind (`0x40` built-in, `0x80` custom). `FF` ends the list. Bit 7 of the text number = double height, bit 7 of an effect = blink |
| Effects | 0 none, 1 random, 2–3 walls, 4–5 scroll, 6–7 curtains, 8 Invaders, 16 rockets, 32–36 Pac, Boulder, Miner, Archer, Aeroplane |
| Custom logos | 10 logos of 15 × 16 pixels, 32 bytes each, shown with custom characters 0–2 and 4–6 |
| Character set | Not the usual HD44780 table: European letters at `0x80`–`0x9F` (ä `0x84`, ö `0x94`, å `0x86`), katakana at `0xA0`–`0xDF` |
Here is a reverse engineered editor for editing your Tagsu:
### Links
- [Tagsu Editor](/tagsu/)
- [github.com/infr/tagsu](https://github.com/infr/tagsu)
- [12kbps data transfer for AVR using audio](https://firebay.pelaaja.info/embedded/12kbps-simple-audio-data-transfer-for-avr/)
- [tagsu-avr-modem](https://github.com/Jartza/tagsu-avr-modem)
- [The story of Tagsu (archived, in Finnish)](https://web.archive.org/web/20160531133748/http://labs.rakettitiede.com/tagsun-tarina/)
---
_The editor is an unofficial compatibility fix because the original site is gone. Not affiliated with Rakettitiede._
Tagsu editorWrite screens and send them to your badgeOpen editor