Doug Brown [Electronics repair](https://www.downtowndougbrown.com/category/electronics-repair/)
, [Microcontrollers](https://www.downtowndougbrown.com/category/microcontrollers/)
, [Reverse engineering](https://www.downtowndougbrown.com/category/reverse-engineering/)
 2024-09-15

This post has a little bit of everything. Hardware diagnostics, some suspiciously similar datasheets from two separate Taiwan chip manufacturers, and firmware reverse engineering. Read on if that sounds like fun!

Lately, I’ve been enjoying watching random electronics repair channels on YouTube. There’s something oddly satisfying about watching someone take a broken device from totally nonfunctional to perfectly working, all by replacing a $0.05 capacitor that has failed shorted or maybe a blown $0.75 IC. Two of my favorite channels about this topic are [Buy it Fix it](https://www.youtube.com/@BuyitFixit)
 and [StezStix Fix?](https://www.youtube.com/@StezStixFix)
.

The videos inspired me. I thought, “I should totally try this!” So I went on eBay and looked for broken devices. I have a pretty decent understanding of how video encoders and decoders work, so I thought it would be a fun project to try to fix an HDMI capture card. I found a broken Elgato Game Capture HD60 S USB 3.0 device. The listing said that nothing happened when you plugged it in.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/hd60s.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/hd60s.jpg)

When it arrived, I was able to verify exactly what the listing said. Nothing showed up on my computer when I plugged it in. I cracked it open and had a look at what was happening internally when it powered up. I started by poking around at voltages on the board with it plugged in, and it was pretty obvious that something was dragging the power rails down. Little did I know at that point what I was getting myself into.

Honestly I could tell what was getting hot just by feeling around with my finger, but this was a good excuse to use my thermal camera to take some fun pictures.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/hot1.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/hot1.jpg)

In this one, the red cursor indicating the hottest point in the image is pointing to a small chip in the upper-left corner of the board marked “fiVJVE”.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/fiVJVE-300x243.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/fiVJVE.jpg)

This was pretty clearly some kind of a switching regulator, which I concluded due to its proximity to the “2R2” inductor (meaning 2.2 uH). Measuring the pins, I could see 5V going in, but obviously something was wrong because the voltage at the inductor (the output) was far too low.

There was also another fiVJVE chip on the board, with a pretty much identical circuit next to another 2.2 uH inductor. The circuit was missing a component, but I was pretty sure it was normal because the solder blobs looked like they came that way from the factory. It wasn’t getting hot, but it was also putting out a low voltage so I suspected something was wrong with it too:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/fiVJVE2-300x219.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/fiVJVE2.jpg)

In the heat image above you can see another area on the board (near the bottom) that was also getting hot. It turns out it was actually originating from the other side:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/hot2.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/hot2.jpg)

Yeah, that’s my finger in the picture. It helped adjust the levels in the image so the chip that’s getting hot is easier to pinpoint. This chip was labeled PFNI:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/PFNI-300x216.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/PFNI.jpg)

OK, so what could I do with this information? I found two chips that were getting hot, and another chip that likely wasn’t putting out its correct voltage. I started out by trying to identify what they were. Small chips with markings like this can be quite difficult to figure out. Luckily, there are a few SMD marking code search engines out there. Searching [smd.yooneed.one](https://smd.yooneed.one/)
 for fiVJ didn’t result in any exact matches, but it did point out that the code “fi” went with the Fitipower FP6121-IS9P. This led me to [Fitipower’s website](https://www.fitipower.com/en)
, where I saw they had a bunch of different chips. Using Google’s help I was eventually able to narrow it down to being the FP6373A.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image.png)

The pinout made sense on the board, and the fiV marking also matched. Yay! Now I had an idea what I was looking for. The PFNI chip ended up being even easier to identify. Google led me straight to the [TI TPS60403DBV voltage inverter](https://www.ti.com/product/TPS60403)
:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-1.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-1.png)

One thing in common with all of these chips is they were all taking in 5V for their input and I was measuring that their outputs all had a pretty low resistance to ground. I started wondering if maybe someone fried this device by somehow putting more than 5V into it. How they did that, I have no idea.

I wasn’t sure why the other FP6373A regulator wasn’t getting hot. It wasn’t putting out much voltage and nothing else was getting hot on the board, so I decided to try injecting voltage on its output power rail instead to see where the low resistance was coming from. I could deduce its correct output voltage because it was going to a Winbond W25Q32JVSSIQ SPI flash chip rated for 2.7 to 3.6V. I was pretty sure it was on a 3.3V rail. I soldered wires to the regulator’s output and ground and used my bench power supply to inject 2.7V into the circuit with a small controlled current that I could slowly turn up. The idea was that I could find what was getting hot on the board and determine what to blame for this power rail being bad.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/powerinjection.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/powerinjection.jpg)

This process pretty quickly revealed the FP6373A itself as the root problem.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/hot3.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/hot3.jpg)

I think maybe during normal operation when it was being supplied with 5V, it was putting itself into some kind of safety shutdown mode and killing its output power rail. The datasheet does mention overcurrent and overtemperature shutdown capability. When I injected voltage directly, the regulator couldn’t shut off the power rail so it had no choice but to get hot and announce “hey, I’m the problem!” through my thermal camera.

This was actually great. I wasn’t totally confident about whether the TI chip was to blame rather than something downstream of it, but since two other chips on the 5V rail were also fried, I thought a good first step would be to replace all three of them and see what would happen. Unfortunately the FP6373A isn’t available at the usual US distributors, but I was able to find it for sale on [LCSC](https://www.lcsc.com/)
 at $0.17 a pop, and the TI chip was conveniently also available there for $0.58. Would it really be this easy? Just replace three chips totaling less than a dollar in value, even in quantities of 1? The shipping and handling was orders of magnitude more expensive than just the parts themselves!

After the parts arrived from China, I was able to successfully replace them. I’m always paranoid about upsetting nearby resistors and capacitors when I’m using hot air, so I like to use Kapton tape to shield everything else.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/removal-1024x619.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/removal.jpg)

The process of soldering in the new chips was mostly easy, but the ground pins did soak up quite a bit of heat. I think this PCB design doesn’t have great thermal relief on the grounds. I did accidentally lift a pad for one of the regulators, but it wasn’t connected to anything (the “PG” signal) so there was no harm done. The fact that it wasn’t connected to anything was exactly why it was so easy to lift it. Also, the heat that the ground pin was eating up misled me into thinking I could use the same heat on the other pins.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/soldered.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/soldered.jpg)

In addition to my lifted pad (middle pin on the right), you can see here how much trouble I had soldering the ground pin (middle pin on the left). It really didn’t want to heat up. I probably could have heated the whole board to help my soldering iron out, but hey, it’s connected.

Anyway, after replacing all three chips, it worked! None of the new chips were getting hot, the HD60 S showed up as a USB device when plugged in, and it worked perfectly for capturing and passing through an HDMI signal. I was pretty excited to successfully fix it, but there was still a problem: none of the indicator lights worked. There are seven white LEDs and seven red LEDs, and they are supposed to [do various things to tell you what’s going on](https://help.elgato.com/hc/en-us/articles/360058716852-Elgato-Game-Capture-HD60-S-Status-Lights-LEDs)
. The white lights are supposed to blink twice when you first plug it in, for example.

This was a little deflating. I had kind of fixed it, but not really. Now what?

Back to the drawing board. I looked closer at the PCB to understand how the LEDs work. The relevant chip is the IT1504, made by [Innochip](https://www.innochip.com.tw/)
. Looking further at [its datasheet](http://www.innochip.com.tw/datasheet/IT1504.pdf)
, it is a 16-channel LED driver chip. You talk to it with a serial data interface that appears to be very similar to SPI. It turns out a lot of LED driver chips from many manufacturers such as Toshiba and ST also use this same communication scheme. At first I though it was odd, but it seems pretty standard. It’s a variant of SPI where you send a particular number of clock pulses to choose which command you want to perform.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/it1504probe.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/it1504probe.jpg)

I monitored the relevant data input pins on the IT1504 using my oscilloscope, and I could definitely see some traffic being sent to it. By the way, I followed the traces and discovered that the IT1504 is being controlled by a Nuvoton M031LD2AE microcontroller, which is an ARM Cortex-M0.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/nuvoton-300x300.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/nuvoton.jpg)

The presence of SPI traffic here proved it was at least trying to do _something_, so I assumed that the LED driver chip was probably fried. That presented a pretty big problem though: how could I find a replacement for the IT1504? It wasn’t stocked anywhere. LCSC didn’t have it, and of course none of the US distributors had it either. I couldn’t even find any sellers on AliExpress or utsource.

I reached out to Innotech, who surprisingly wrote back the next day and kindly offered to send me a few free samples for the price of shipping, but then realized they only have full reels in stock so they couldn’t send me any samples. That was nice of them to check, but I definitely wasn’t going to buy a full reel of IT1504 chips just to fix this one problem.

This pushed me toward a huge search all over the internet for LED drivers to try to find a suitable equivalent replacement. The IT1504 datasheet I had access to didn’t include the full command info, so I wasn’t sure exactly what I was looking for. There were several discontinued parts from other well-known manufacturers that looked similar, but I wasn’t finding any exact matches. That’s when I discovered something really strange.

I somehow stumbled upon [Macroblock](https://www.mblock.com.tw/en)
‘s product offerings. Specifically, the MBI5040. The datasheet seemed to match up pretty well with the IT1504. In fact, a little too well. Here is an example of what I mean (click if you want it larger so you can read it):

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-2-1024x357.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-2.png)

Here are a few more side-by-side comparisons to really hit the point home:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-3-992x1024.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-3.png)

They’re almost exactly the same! Everything is laid out in precisely the same order. The current output specs differ slightly, but aside from that, they’re the exact same product, right down to having identical block diagrams. The wording has been tweaked here and there, but both of these datasheets are clearly from the same source. These companies are both based in Taiwan. Maybe one of them licensed the design from the other? Or perhaps there is some industrial espionage going on? There is definitely some funky stuff going on with the fonts on the Innochip datasheet’s general description page. It randomly switches around between serif and sans-serif. It’s the kind of thing you notice when you’re reading an email that somebody sent and you can tell they’ve obviously been copying and pasting while writing it. That doesn’t necessarily mean anything, but I thought it was weird.

Heck, even the part numbers are pretty much the same. If you pretend that the capital letter “I” in MBI5040 is really the number 1, you have MB**1504**0 and IT**1504**.

I have no idea which product is the original here, but either way, this was really good news for me. I had successfully discovered another chip that would likely be suitable as a replacement for my assumed-to-be-fried IT1504. Additionally, the MBI5040 datasheet actually had command info, so if it came down to it, I could dive deeper and really try to understand what the SPI traffic was doing. I was able to find the MBI5040GF available for purchase on both AliExpress and utsource, so I bought a few.

Replacing the LED driver chip was a pretty simple job. Once again I used Kapton tape to protect me from myself.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/it1504removed.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/it1504removed.jpg)

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/solderingreplacement.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/solderingreplacement.jpg)

I was feeling pretty good about my situation at this point. I cleaned up all the flux residue and anxiously plugged in the HD60 S to my computer.

Video capture worked fine, so I didn’t make it any worse, but the lights were still not working! What in the world? Next I started wondering if perhaps the LEDs themselves were broken. I rigged up my bench power supply and a resistor so that I could pass current through them (without the whole device powered on, of course), and the LEDs all tested out fine physically. I was able to light each one up.

I was totally out of ideas at this point. A brand new chip didn’t fix it, and the LEDs were known good. That’s when I started searching on Google and found something shocking: apparently the LEDs going out on these Elgato HD60 S capture cards is a known problem that multiple people have experienced. In particular I found two different Reddit posts with four unique users complaining about running into this same problem:

*   [https://www.reddit.com/r/elgato/comments/pcvtqj/why\_doesnt\_my\_elgato\_hd60s\_light\_up/](https://www.reddit.com/r/elgato/comments/pcvtqj/why_doesnt_my_elgato_hd60s_light_up/)

*   [https://www.reddit.com/r/Twitch/comments/qfdxuu/elgato\_hd60\_s\_can\_anyone\_help\_me\_with\_this\_issue/hhzsvez/](https://www.reddit.com/r/Twitch/comments/qfdxuu/elgato_hd60_s_can_anyone_help_me_with_this_issue/hhzsvez/)

Not only that, but sometime during this whole saga I also bought another “dead” HD60 S on eBay that turned out to work fine but had the exact same LED fault. It was starting to look like this indicator light failure was actually quite common!

So yeah. It’s very likely that the LEDs on this one weren’t working even before the voltage regulators originally got fried. This led me to a new bonus challenge: Could I figure out why the LEDs didn’t work and fix them? After all, I now had two different units both experiencing this failure and I knew of at least four other people with the same problem. If you go to the parent post at the second link above, there’s a video that shows how the white LEDs are expected to flash white twice when you first plug it in.

My first idea was to verify that the actual LED circuitry on the board was functional. To perform this test, I lifted the relevant SPI input pins on my replacement MBI5040 LED driver and soldered wires to them, as well as ground:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/solderedwires1.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/solderedwires1.jpg)

This allowed me to rig something up with a Raspberry Pi Pico to manually control the LEDs by sending the appropriate commands as documented in the MBI5040 datasheet. I’ll let this picture speak for itself:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/litup.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/litup.jpg)

It was at this point that I became very confident there was nothing physically wrong with my repaired HD60 S at all. I could perfectly control the lights with my Pi Pico, so the circuit was fine. The Nuvoton Cortex-M0 microcontroller was simply never deciding to turn them on.

This whole MBI5040 replacement story was all for nothing! I was so proud of myself for finding a suitable substitute IC, but it was all mostly just a big waste of time. The original chip was probably fine all along. I decided to confirm that theory just to be sure. I put the original IT1504 chip back onto the board. In order to avoid having to bend pins, I covered the 3 pads that I wanted to avoid soldering to the chip with Kapton tape. This kept them insulated, and then I just soldered all of the other pins normally.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/it1504resoldered.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/it1504resoldered.jpg)

Then I resoldered the wires and repeated the experiment with the Pi Pico. No surprises here — the original chip was totally fine too. After I was done tinkering, I simply pulled the Kapton tape out and then was able to solder the remaining 3 pins normally. I thought this solution was pretty clever and saved me some time! Here’s a view after I pulled out the tape, but before I soldered them down.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/it1504resoldered2.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/it1504resoldered2.jpg)

And yes, I know pin 1 looks messy. Once again, it’s a ground pin and I guess they didn’t add thermals on the ground pins on this board. It was a pain to solder. I fixed it up afterward though.

So yeah. The original IT1504 chip worked fine. I was a little annoyed, but this side quest wasn’t entirely a waste of time. Getting ahold of the MBI5040 datasheet importantly gave me a perfect reference for how the LEDs are controlled by software. It was looking more and more like this was a software problem as opposed to a hardware problem. I was invested in this problem at this point. I couldn’t give up now!

I began the next phase of this project with a simple idea: ask Elgato if there is some kind of known issue with the status lights. Maybe there was a setting I was missing that allowed you to disable them. Essentially, they politely told me to take a hike:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-9.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-9.png)

That’s okay. I felt like solving it on my own anyway. I decided to focus on understanding what was going on in the firmware running in the Nuvoton M031LD2AE microcontroller. By a stroke of pure luck, I had [gained some experience last year with Nuvoton MCUs when working on my Mac ROM SIMM programmer](https://www.downtowndougbrown.com/2023/09/porting-my-mac-rom-simm-programmer-from-avr-to-arm/)
. I already had a [Nu-Link2-Me](https://www.nuvoton.com/tool-and-software/debugger-and-programmer/1-to-1-debugger-and-programmer/nu-link2-me/)
 that was bundled with the dev board I bought for that project. The next step was to figure out how to access the programming pins on the microcontroller. It turns out that there are a couple of small JST connectors on the board: a 4-pin one and a 6-pin one. Tracing out the pins one by one, it quickly became apparent that the 4-pin JST connector was for programming the MCU! I hooked it up using the only 4-pin JST cable I had on hand, which had grabbers on the other end.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/nulink.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/nulink.jpg)

I didn’t check, but I think it’s a pretty good educated guess that the 6-pin JST connector next to it is for programming the Altera MAX II CPLD that is also on this board. It just makes sense.

I didn’t care about the CPLD though. I tried to read the firmware out of the Nuvoton chip using NuMicro ICP Programming Tool, but of course Elgato protected the contents:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-4.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-4.png)

Never fear, though. It turns out that Elgato includes the latest firmware with their 4K Capture Utility:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-5.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-5.png)

Reading the included ElgatoDeviceCapabilities.json file in the same folder also provided some insight. This firmware is specifically for the version of the device with USB product ID 118 (0x0076), which definitely matches mine. Elgato refers to this device as the “Game Capture HD60 S Rev.4”:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-6.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-6.png)

The firmware was already up to date when I checked in the 4K Capture Utility. You can also control-click the settings icon to enable an Update Firmware button, but it did nothing because the newest firmware was already installed on it:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-7.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-7.png)

This was great though! The FW\_HD60\_S\_MCU.bin file looked very much like a normal Cortex-M0 firmware binary. You can tell by looking at the start of it in a hex editor. The very first 4-byte word should be the initial stack pointer, so something in RAM. Then following that is a bunch of interrupt vectors including the reset vector.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-8.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-8.png)

This all checked out. 0x20000E70 looks like a valid stack pointer, and each 4-byte word following that looks like a valid flash address. It looks exactly like a Cortex-M0 vector table. I loaded it into [Ghidra](https://ghidra-sre.org/)
 and also used [SVD-Loader](https://github.com/leveldown-security/SVD-Loader-Ghidra)
 to try to map out some of the registers. I had to modify the SVD file (M031AE\_v1.svd), which I got from the [NuMicro\_DFP pack on keil.arm.com](https://www.keil.arm.com/packs/numicro_dfp-nuvoton/devices/)
, to get it to load with the plugin. Apparently it doesn’t like if you have multiple addressBlocks per peripheral, so I modified the first one in each peripheral to contain the full range of addresses.

And thus began the humongous effort of trying to figure out what this little MCU was actually doing.

The SVD file helped me identify the various peripherals being used: mostly GPIO, a timer, and I2C. [Nuvoton’s M031BSP project](https://github.com/OpenNuvoton/M031BSP/)
 was very valuable for identifying a ton of functions. I did it by hand, which was probably slightly insane, but I wasn’t sure what compiler had been used. Since I knew which pins were hooked up to the LED controller chip, I was fairly quickly able to identify functions that control the LEDs. It was hard to understand their purpose in the grand scheme of things though. Sometimes they were buried deep inside multiple layers of function calls.

Knowing that I2C was being used was very helpful, because I saw there were other chips onboard that would communicate through it: the ITE IT6802E and IT66121FN. The IT6802E is an HDMI receiver. I don’t have any detailed documentation for it, but I’m pretty sure it converts an incoming HDMI signal into a parallel data stream suitable for the capture portion of the device to read in. The IT66121FN is the opposite. It takes a parallel data stream and sends it out as HDMI. This would be necessary for the passthrough functionality, providing an HDMI output signal to go through to your TV or monitor.

Anyway, I found some ITE driver code in some random GitHub projects [such as this one](https://github.com/densengithub/DB_C10)
, which quickly helped me identify a bunch of functions and variables as belonging to ITE’s drivers. This helped me gain a better understanding of what was happening in the firmware. I actually spent way too much time on this, but I think it was useful in the long run. Plus, it was good practice with Ghidra.

Once I had a good idea of the overall structure of the firmware, I decided to try figuring out how I could debug the code. The chip was protected, but I figured that I should be able to erase it and reflash the firmware. To be safe, I desoldered the original M031LD2AE chip and put a new empty one onto my board instead. They only cost $1.14 on Digi-Key in quantities of 1. Why not?

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/soldernuvoton.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/soldernuvoton.jpg)

When I flashed FW\_HD60\_S\_MCU.bin onto my brand-new blank chip, it definitely worked fine, but it re-protected itself so I couldn’t do any debugging! The offending code was pretty easy to find in Ghidra. There’s a function that is called to update the config registers with the proper locked state as well as the number of 512-byte data flash pages to reserve from the application ROM.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-10.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-10.png)

I simply had to hack this function to always leave the chip unlocked. Then I reflashed the chip and I was finally able to debug the code! I inserted some breakpoints and stepped through the initialization code with OpenOCD and GDB to figure out why the LEDs weren’t being controlled. I found some places in the code where LED control would happen, but they were being skipped. I decided to force the code to run by filling in register values and RAM in GDB, and sure enough, I was able to at least force the lights to turn on. So clearly the code was there to control the lights, but it wasn’t running for whatever reason.

This chip unlocking mess led me down another rabbit hole. I assumed that the original Nuvoton MCU I removed had some other protected contents like a bootloader, so I decided to see if I could extract it by installing my new unlocked firmware file as an update through Elgato’s software. The idea was that after my new unlocked firmware was installed, the protection would be disabled and then I could read out the entire contents with my Nu-Link2-Me. Why would I want to do this? Well, it would just be nice to have as a backup in case I screwed up one of the chips, plus the bootloader might contain other clues.

I tried it out on my _other_ HD60 S with broken LEDs which still had its stock Nuvoton MCU fitted. This required modifying ElgatoDeviceCapabilities.json to point to my unlocked firmware. I also had to change the version listed in this same file so that it would think it was out of date. After making these changes, the 4K Capture Utility allowed to install my new firmware through the normal firmware update mechanism. The utility did tell me the firmware update failed after it finished (more on that later).

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/update3.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/update3.png)

This totally freaked me out because it appeared to brick the device. It didn’t work as a capture card anymore. But luckily, but I was left with an unlocked chip, just as I had hoped! This allowed me to read out the rest of the content of the flash that had previously been protected, including the LDROM (containing Elgato’s first-stage bootloader), data flash contents, and the correct original config register contents. This was **really** exciting because it meant I now had everything I would need in order to completely program a brand new Nuvoton MCU to contain Elgato’s stock firmware, including their bootloader. I rewrote the original Elgato firmware back to this second HD60 S’s APROM (application ROM) using Nuvoton’s tools, and re-locked the chip. Thankfully, this fully restored it to working order — except for the LEDs of course.

I also disassembled their small LDROM bootloader that I was able to read out of the chip, but it wasn’t really anything exciting. It receives commands and data over I2C and is capable of reflashing the APROM. Interestingly I discovered that if the chip is set for unprotected mode, the bootloader actually waits around for update commands instead of booting the application firmware. So Elgato is using the locked/unlocked bit as a way of signifying whether it should stay in the bootloader or not, which I find to be a little bit weird. That completely explained why my second HD60 S stopped working after I installed my unlocked firmware — it was stuck in the bootloader waiting forever because the chip was unprotected.

Anyway, I’ve really started to ramble on about things unrelated to the LED problem. Let’s get back on track. The point I’m trying to make here is that I was able to read out all of the stock microcontroller contents, which gave me the confidence I desperately needed in order to start tinkering even further to figure out the LED problem. I was kind of stuck at this point though. Why was the Nuvoton chip not controlling the LEDs? Some of the LED control happened over I2C from something else, so I was beginning to worry that the actual problem was once again at a different level.

Fortunately though, I was gaining a better understanding of the architecture of the entire product at this point. Here’s a broad overview of how it works:

*   The main Cypress/Infineon CYUSB3014 USB 3.0 peripheral chip, which I haven’t mentioned until now, is an ARM926EJ-S. It sends commands to the Nuvoton MCU over I2C. This is the chip that actually communicates with the host PC through the USB 3.0 port.
*   The Nuvoton ARM Cortex-M0 microcontroller sets up and monitors the ITE video receiver and transmitter chips through a separate I2C bus.
*   The Nuvoton MCU also controls the LEDs.
*   The Nuvoton MCU communicates status information back to the CYUSB3014 through I2C.
*   The CYUSB3014 receives the video data stream from the IT6802E (likely through the MAX II CPLD, putting it in a format suitable for the CYUSB3014 to grab) and sends it to the computer over USB.

I thought I would take a break from the Nuvoton chip for a while and start trying to understand the main Cypress processor instead. Yes, as I just mentioned above, there are two different ARM processors working together to implement the video capture functionality. Fortunately, Cypress/Infineon also provides a free SDK for these USB chips. The firmware is stored unprotected in the Winbond W25Q32JVSSIQ flash chip that I talked about very early on when I thought this was purely going to be a hardware repair project.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/spiflash.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/spiflash.jpg)

I desoldered the SPI flash chip and read it back using a programmer. It’s a 4 MB (32-megabit) chip. I also tried to do it in-circuit without removing the chip first, but I didn’t have any luck. I even accidentally knocked a small 0402 0.1 uF decoupling capacitor (seen above on the right) off the PCB while I was trying to clip onto it. Luckily the capacitor wasn’t damaged and I was able to put it right back on.

After dumping the chip contents, I used it to start trying to work my way through understanding what the CYUSB3014 was doing. I was able to use Cypress’s existing SDK binaries to help identify a lot of the functions in the dump. It turns out that the Cypress SDK uses the ThreadX RTOS under the hood.

I really didn’t want to dive deep into this firmware to the same level that I did for the Nuvoton chip though. I was already worn out from that disassembly. At the very least, I was able to see that the Cypress chip sends commands over I2C to the Nuvoton chip.

Looking through the rest of the SPI flash dump, I could see that starting at offset 0x300000, there were a bunch of small data chunks that looked like little pictures. Here’s an example:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-11.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-11.png)

I couldn’t figure out why there would be little pictures in the flash chip here. What would the purpose be? It made me wonder if maybe it was some kind of small icon, since I’ve seen similar data for icons while analyzing old Mac ROM dumps. Given the context of this blog post, you might be screaming at me right now telling me what this data obviously is, but at the time I was totally oblivious.

I ended up solving this mystery as soon as I started looking into what was going on with five unknown GPIO pins in the firmware on the Nuvoton chip. There were a bunch of functions that controlled these pins, but I wasn’t sure what they did. I traced them out on the PCB and discovered they were going to a [Diodes Incorporated PI5C3257 quad 2:1 mux/demux bus switch](https://www.diodes.com/assets/Datasheets/PI5C3257.pdf)
.

This was the magic discovery that finally unblocked me. This bus switch is being used to decide whether the CYUSB3014 chip or the Nuvoton microcontroller should be wired up to the SPI flash chip. Prior to this moment, I thought that the SPI flash was entirely dedicated to the CYUSB3014. In reality, the Nuvoton microcontroller takes over control of the SPI flash after the CYUSB3014 has finished booting. This enabled me to disassemble a bunch of new functions which were all related to bit-banging SPI transactions, as well as higher-level functions for SPI flash chip erasing/reading/writing.

A light bulb went off in my head. Yes, these chunks of data in the flash chip **were** pictures! But not in the conventional sense. They were describing the various LED animations. Each set of 16 bytes is an animation frame written to the 14 LEDs. In the example above, a single red LED turns on and six of the seven white LEDs do stuff. The last two bytes in each row are a delay time before moving onto the next frame. The first 16 bytes looked kind of weird though. They looked like they possibly contained some header data for the animation or something.

I also found some code that was reading data from the start of the 0x300000 section, but in my SPI flash dump that section was pretty much completely empty:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-12.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-12.png)

Everything was starting to make sense. There was a check in the Nuvoton MCU firmware to see if the first two bytes contained the 16-bit word value 0xAA55:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-17.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-17.png)

In my dumps of the SPI flash chip contents from my units with nonfunctional LEDs, that section of the chip was empty. It was programmed as all 0x00. The firmware was bypassing all of the LED control code because expected data wasn’t stored starting at 0x300000 in the flash chip! I confirmed this data was missing on both of the HD60 S devices I was testing with.

Unless I wanted to go overboard trying to figure out how to artificially populate all this data from scratch, I had no choice but to buy a third HD60 S that was confirmed to be fully functional. That’s what I ended up doing. Unfortunately it was an older revision and had a completely different PCB, but it was still based on the CYUSB3014. It also used a Nuvoton microcontroller, but it was a different model. It still had an IT1504 for LED control though, as well as a Winbond SPI flash chip, so that was promising.

I confirmed that its LEDs worked fine, and then I dumped the SPI flash. By this point, I had figured out how to dump the flash contents without any soldering by forcing the CYUSB3014 to boot over USB (removing a jumper on the board) and then uploading a Cypress-provided RAM bootloader capable of dumping the SPI flash (cyfxflashprog.img), but I don’t want to stray too far from the LED issue at this point. Here’s the start of the good data at 0x300000:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-13.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-13.png)

Okay, that data makes way more sense. The first 16-bit word (little-endian) is 0xAA55 just like the firmware was looking for. It also has a bunch of other header data, indicating there are 26 different LED animations, and including info about whether they are even animations at all. To be honest, I haven’t figured out what every piece of this data actually means, but each animation has a 16-byte summary. They start at 0x300008. I think the last 4 bytes for each animation are probably a CRC-32 of something.

Also, if you noticed in the original chip dump, there was a section starting at 0x3000B8 with a bunch of 0xE5 bytes. This is the dot correction data that gets loaded into the IT1504. Based on the decompilation above, it’s actually supposed to be at 0x3007F8, which is exactly where it is in the good dump:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-14.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-14.png)

The 0x521114A7 that follows is a CRC-32 of the preceding 16 bytes of data.

Further inspection revealed that the data in the SPI flash of the broken devices differed quite a bit. In fact, they were different from each other as well. This led me to believe that the animation data was probably corrupted in them. For example, here’s what the animation at 0x31E000 looks like in the good HD60 S’s dump:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-15.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-15.png)

Notice how there is no weird header at the top like the original “picture” I was inspecting from one of the other dumps? It just immediately starts with animation data that is consistent with the rest of the nearby data. It’s also longer. This data makes a lot more sense. On the other hand, it was corrupted in two completely different ways in my two HD60 S devices with nonfunctional LEDs.

Several (but not all) of the animations in my nonworking devices started with a weird “AB 03 12 39” header. I don’t think the header is supposed to be there. Maybe there was a bug in an update procedure or something? The Nuvoton firmware indeed has functions capable of erasing and rewriting data to the SPI flash chip. I’m wondering if that code ended up running and somehow destroying the original contents.

You may be able to guess what I did with this new knowledge. I took the original SPI flash contents from the two devices with nonfunctional status lights, and simply replaced all the LED data starting at 0x300000 with the data from the working one. Then I flashed this new “hybrid” image to the non-working devices. Oh, I should point out that each device has its own unique flash dump. The USB serial number is embedded in there somewhere. So I preferred to preserve the data from 0 to 0x2FFFFF for each individual device.

I wasn’t entirely sure what to expect by trying this. The good SPI flash data came from an older revision of the product with a different Nuvoton microcontroller, but it sure looked like it matched what the newer firmware was looking for.

Here’s a picture of what I saw as soon as I powered one of the problematic devices after I reflashed its SPI flash chip:

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/success1.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/success1.jpg)

It freaking worked. The white lights flashed twice, and then the red lights briefly flashed once.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/success2.jpg)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/success2.jpg)

I think the red flash just means the signal was lost, because it also does it every single time I unplug an HDMI source from it. The older model doesn’t do this red flash on every powerup, but maybe it’s just a firmware difference about whether it should say “signal lost” immediately at startup with nothing plugged in. I’ve seen some mention online of red lights meaning that the signal is HDCP-protected, but I think that’s a different longer red blink which I’ve also seen when I first plug in my iPhone as an HDMI source.

I’ve also noticed that some of the animations that Elgato says it should do, like when I start or stop recording, don’t play on this newer model, even though they work fine with the older model. I haven’t been able to figure out if this is just a known difference with how the newer model works. I may try to get a good SPI flash dump of the correct LED animations from a newer matching model to confirm it for sure, but I have a feeling the animation data will be identical.

I also recently realized that the raw data for each animation is sitting around in C:\\Program Files\\Elgato\\GameCapture\\Animations if you have the older Game Capture utility installed, or /Applications/Game Capture HD.app/Contents/Resources/Animations on Mac.

[![](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-16.png)](https://www.downtowndougbrown.com/wp-content/uploads/2024/09/image-16.png)

Looking through each file (01.ani, 02.ani, etc.), it looks like the animation data perfectly matches my dump of the older working device. The bytes for each LED are out of order, but if I reorder them correctly, I can create an identical copy of all of the animation data that I extracted from the good flash chip.

Since those animations live inside the Game Capture app (or next to it), it seems as though the software has the capability to load them into the flash chip. I wonder if that explains how the stored animation data ended up corrupted in the first place. A botched update perhaps? That would make sense to me. Maybe they disabled the ability for their software to upload them after they discovered it was screwing up people’s devices? It might be interesting to disassemble the Windows and/or Mac software and try to figure out how to convince it to directly upload the animations, but I’m honestly out of motivation to do that at this point. It looks like LedCtrlDll.dll might be an interesting file to look at if anyone else is hooked enough to continue diving deeper. It contains classes with interesting names like Ub530LedSpiRom and I2cIO\_Ub530. Some quick disassembly in Ghidra indeed shows it creating a 0x80C-byte array for the header data that would go into the flash chip at 0x300000, and populating the contents with the dot correction data.

One last thing I noticed is if I do a firmware update of the HD60 S inside of Elgato’s 4K Capture Utility in Windows, it doesn’t wait long enough. It seems to work fine on Mac, but Windows has some issues. The firmware update is still in progress when it tells me that it failed. If I sit there and wait, eventually the lights flash on the unit and it successfully reboots into the new firmware. If instead I unplug it quickly after Elgato’s software tells me the update failed, I end up with an incomplete flash. I wonder if this has fooled people into bricking their devices? Especially if the status LEDs don’t work at all. I was able to successfully fix this problem by increasing the updateDurationSec in ElgatoDeviceCapabilities.json from 40 to 80. I get the feeling Elgato’s firmware update functionality is a little flaky, at least on Windows. In Elgato’s defense, [they specifically recommend _not_ to update firmware on the HD60 S unless their tech support tells you to](https://help.elgato.com/hc/en-us/articles/360027955132-Firmware-updates-and-Elgato-hardware)
. And they hide the functionality behind a special key combination when entering the settings screen.

I would like to figure out a way to share how to easily fix the LEDs for anyone else who runs into this problem, but the process is admittedly quite convoluted. It requires you to begin a firmware update (modifying ElgatoDeviceCapabilities.json to even allow you to install an update in the first place) and immediately unplug the device — otherwise the Nuvoton MCU takes control of the SPI flash, and you really need the Cypress chip to be in control in order to reflash its contents. Then, you remove the jumper on the PCB (instructing the Cypress chip to boot from USB), upload cyfxflashprog.img to RAM using download\_fx3, and use a modified version of fx3\_spitest to download the entire SPI flash contents and replace it with your patched LED section. Those are tools from the CYUSB3014 SDK. Finally, you unplug it, put the jumper back in, plug it back in, and perform a normal firmware update in 4K Capture Utility to restore the firmware back to the Nuvoton chip. You ignore the update failure message and wait another minute or so, and eventually it boots back up with working LEDs. If there ends up being enough interest in recovering these things, it might be possible for me to throw something together to automate the process, or at least provide binaries for everything. It would also be nice to figure out how to use Elgato’s software to directly reprogram the LED animations. For now though, I’m just going to sit back, relax, and celebrate my victory on this!

So in conclusion, yes, it really was that simple. All I needed to do was replace three chips for a total of less than $1 to bring this thing back to life. Every bit of extra time and money I spent on this project after that was all about figuring out a well-known indicator LED problem that really had nothing to do with my actual repair. I put way more effort into this than I should have, and yes I am probably a tiny bit crazy for actually doing this, but at least I now have an answer and fix for why the LEDs don’t work on some of these capture cards. It’s some sort of software/programming/update bug. I’m not sure which. Way to go Elgato!

Downtown Doug Brown » Fixing an Elgato HD60 S HDMI capture device with the help of Ghidra

This is a long form article, you can read it in https://habla.news/a/naddr1qvzqqqr4gupzpdens7rzx0w8yxjfvzy83muzujt7emh5j54kw5erwn6mk87mt0lnqqzrzvesxutxyd86


Knocking out one key gene leads to autistic traits
==================================================

Purkinje cells in the cerebellum, stained and magnified 63 times, revealing fine details of the dendritic spines. (Hatten Lab)

More than 70 genes have been linked to autism spectrum disorder (ASD), a developmental condition in which differences in the brain lead to a host of altered behaviors, including issues with language, social communication, hyperactivity, and repetitive movements. Scientists are attempting to tease out those specific associations gene by gene, neuron by neuron.

One such gene is _Astrotactin 2_ (_ASTN2_). In 2018, researchers from the [Laboratory of Developmental Neurobiology](https://lab.rockefeller.edu/hatten/)
 at Rockefeller University discovered how defects in the protein produced by the gene disrupted circuitry in the cerebellum in children with neurodevelopmental conditions.

Now the same lab has found that knocking out the gene entirely leads to several hallmark behaviors of autism. As they describe in a [new paper](https://www.pnas.org/doi/10.1073/pnas.2405901121)
 in _PNAS_, mice that lacked _ASTN2_ showed distinctly different behaviors from their wild-type nestmates in four key ways: they vocalized and socialized less but were more hyperactive and repetitive in their behavior.

“All of these traits have parallels in people with ASD,” says Michalina Hanzel, first author of the paper and a postdoc in the lab. “Alongside these behaviors, we also found structural and physiological changes in the cerebellum.”

“It’s a big finding in the field of neuroscience,” says lab lead [Mary E. Hatten](https://www.rockefeller.edu/our-scientists/heads-of-laboratories/1180-mary-e-hatten/)
, whose work has focused on this brain region for decades. “It also underscores this emerging story that the cerebellum has cognitive functions that are quite independent of its motor functions.”

**An unexpected role**

In 2010, Hatten’s lab discovered that proteins produced by the _ASTN2_ gene help guide neurons as they migrate during the development of cerebellum and form its structure. In the 2018 study, they examined a family in which three children had both neurodevelopmental disorders and _ASTN2_ mutations. They found that in a developed brain, the proteins have a similar guiding role: they keep the chemical conversation between neurons going by ushering receptors off the neural surfaces to make room for new receptors to rotate in. In a mutated gene, the proteins fail to act and the receptors pile up, resulting in a traffic jam that hinders neuronal connections and communication. This impact could be seen in the children’s afflictions, which included intellectual disability, language delays, ADHD, and autism.

The find was part of a growing body of evidence that the cerebellum—the oldest cortical structure in the brain—is important not just for motor control but also for language, cognition, and social behavior.

For the current study, Hanzel wanted to see what effects a total absence of the _ASTN2_ gene might have on cerebellar structure and on behavior. Collaborating with study co-authors Zachi Horn, a former postdoc in the Hatten lab, and with assistance from Shiaoching Gong, of Weill Cornell Medicine, Hanzel spent two years creating a knockout mouse that lacked _ASTN2_, and then studied the brains and activity of both infant and adult mice.

**Behavioral parallels**

The knockout mice participated in several noninvasive behavioral experiments to see how they compared to their wild-type nestmates. The knockout mice showed distinctly different characteristics in all of them.

In one study, the researchers briefly isolated baby mice, then measured how frequently they called out for their mothers using ultrasonic vocalizations. These sounds are a key part of a mouse’s social behavior and communication, and they’re one of the best proxies researchers have for assessing parallels to human language skills.

The wild-type pups were quick to call for their mothers using complex, pitch-shifting sounds, while the knockout pups gave fewer, shorter calls within a limited pitch range.

Similar communication issues are common in people with ASD, Hanzel says. “It’s one of the most telling characteristics, but it exists along a spectrum,” she says. “Some autistic people don’t understand metaphor, while others echo language they’ve overheard, and still others do not speak at all.”

In another experiment, the researchers tested how _ASTN2_ mice interacted with both familiar and unfamiliar mice. They preferred to interact with a mouse they knew rather than one they didn’t. In contrast, wild-type mice always choose the social novelty of a new face.

This, too, has parallels in human ASD behavior, with a reluctance towards unfamiliar environments and people being common, Hanzel adds. “That’s a very important result, because it shows that mice with the knockout mutation do not like social novelty and prefer to spend time with mice they know, which corresponds to people with ASD, who tend to like new social interactions less than familiar ones.”

In a third experiment, both types of mice were given free rein to explore an open space for an hour. The _ASTN2_ mice traveled a significantly longer distance than the other mice, and engaged in repetitive behaviors, such as circling in place, 40% more. Both hyperactivity and repetitive behaviors are well-known hallmarks of ASD.

**Miscommunication between brain regions**

When they analyzed the brains of the _ASTN2_ mice, they found a few small but apparently potent structural and physiological changes in the cerebellum. One was that large neurons called Purkinje cells had a higher density of dendritic spines, structures that are spotted with the synapses that send neural signals. But they only detected this change in distinct areas of the cerebellum. “For example, we found the biggest difference in the posterior vermis region, where repetitive and inflexible behaviors are controlled,” Hanzel says.

The scientists also found a decrease in the number of immature dendritic spines known as filopodia and the volume of Bergmann glial fibers, which help with cell migration.

“The differences are quite subtle, but they are clearly affecting how the mice are behaving,” Hatten says. “The changes are probably altering the communication between the cerebellum and the rest of the brain.”

In the future, the researchers plan to study human cerebellar cells, which they’ve been developing for a half-dozen years from stem cells, as well as cells with _ASTN2_ mutations that were donated by the family in the 2018 study.

“We’d like to see if we can find parallel differences to what we found in mice in human cells,” Hatten says.

She continues, “We also want to look at the detailed biology of other genes that are associated with autism. There are dozens of them, but there’s no agreed-upon commonality that binds them together. We’re very excited that we’ve been able to show in detail what _ASTN2_ does, but there are a lot more genes to investigate.”

* * *

Explore:

[All latest news](/news/)

![Mary E. Hatten](https://www.rockefeller.edu/news/uploads/www.rockefeller.edu/sites/13/2018/09/sidebar_hatten.png)

[**Mary E. Hatten**](https://www.rockefeller.edu/our-scientists/heads-of-laboratories/1180-mary-e-hatten/)

Frederick P. Rose Professor
[Laboratory of Developmental Neurobiology](http://lab.rockefeller.edu/hatten/)

* * *

### Related publication

PNAS

[Mice lacking _Astn2_ have ASD-like behaviors and altered cerebellar circuit properties](https://www.pnas.org/doi/10.1073/pnas.2405901121)

Michalina Hanzel, Kayla Fernando, Susan E. Maloney, Zachi Horn, Shiaoching Gong, Kärt Mätlik, Jiajia Zhao, H. Amalia Pasolli, Søren Heissel, Joseph D. Dougherty, Court Hull, and Mary E. Hatten

* * *

### Media contact

**Katherine Fenz**
Media Relations Manager

*   [212-327-7913](tel:2123277913)

*   [kfenz@rockefeller.edu](mailto:kfenz@rockefeller.edu)

*   [More information for reporters](https://www.rockefeller.edu/public-affairs/journalists/)

*   [@RockfellerUniv](https://twitter.com/RockfellerUniv)

The Rockefeller University » Knocking out one key gene leads to autistic traits

This is a long form article, you can read it in https://habla.news/a/naddr1qvzqqqr4gupzpdens7rzx0w8yxjfvzy83muzujt7emh5j54kw5erwn6mk87mt0lnqqzrzvej8yt24yut


Scramble - Open-Source Grammarly Alternative
============================================

Scramble is an open-source Chrome extension that leverages AI to enhance your writing directly in your browser. It's designed to be a more customizable and privacy-respecting alternative to Grammarly.

GitHub - zlwaterfield/scramble: Open-Source Grammarly Alternative

This is a long form article, you can read it in https://habla.news/a/naddr1qvzqqqr4gupzpdens7rzx0w8yxjfvzy83muzujt7emh5j54kw5erwn6mk87mt0lnqqzrzvenxudqla9m


AI Workout Generator
====================

This is a long form article, you can read it in https://habla.news/a/naddr1qvzqqqr4gupzpdens7rzx0w8yxjfvzy83muzujt7emh5j54kw5erwn6mk87mt0lnqqzrzve5xge9razg


![The Continued Trajectory of Idiocy in the Tech Industry](https://i0.wp.com/soatok.blog/wp-content/uploads/2024/09/BlogHeader-2024-Tech-Industry-Idiocy.png?fit=1200%2C675&ssl=1)

Every hype cycle in the technology industry continues a steady march towards a shitty future that nobody wants.

![Sad Sticker](https://i0.wp.com/soatok.blog/wp-content/uploads/2021/03/soatoktelegramswave3-04.png?resize=512%2C512&ssl=1)

[CMYKat](https://cmykat.carrd.co/)

The Road to Hell
----------------

Once upon a time, everyone was all hot and bothered about **[Big Data](https://web.archive.org/web/20211106230607/https://bernardmarr.com/whats-really-behind-the-big-data-hype/)
**: Having lots of information–far too much to process with commodity software–was supposed to magically transform business.

How do you build technology that can process that much information at scale? Well, obviously, you just need to invest in **The Cloud**! (If you’re using the _Cloud to Butt Plus_ Chrome extension, this entire blog post may be confusing to you.)

But don’t scrutinize the Cloud too long, you might miss your chance to invest in **[blockchain](https://tonyarcieri.com/on-the-dangers-of-a-blockchain-monoculture)
**.

![Oprah meme. YOU GET A BLOCKCHAIN! AND YOU GET A BLOCKCHAIN! EVERYBODY GETS A BLOCKCHAIN!!](https://i0.wp.com/soatok.blog/wp-content/uploads/2024/07/blockchain.png?resize=600%2C518&ssl=1)

meme [via Tony Arcieri](https://tonyarcieri.com/on-the-dangers-of-a-blockchain-monoculture)

Blockchainiacs practically invented an entire constructed language of buzzwords. Things like “DeFi”, “Web3”, and so on. To anyone not accustomed to their in-signaling, it’s potent enough cringe to repel even the weirdest of furries.

![Bleh Sticker](https://i0.wp.com/soatok.blog/wp-content/uploads/2021/04/soatoktelegramswave3-09.png?resize=512%2C512&ssl=1)

[CMYKat](https://cmykat.carrd.co/)

But the only thing to know about blockchain is its proponents they like it when the line goes up, and every “innovation” in that sector was in service of the line going up.

Blockchain, of course, refers to [cryptocurrency](https://soatok.blog/2021/04/19/a-furrys-guide-to-cryptocurrency/)
. The security of these digital currencies is based on expensive consensus mechanisms (e.g., Proof of Work). The incentives baked into the design of these consensus mechanisms led users to [buy lots of GPUs](https://www.techradar.com/news/cant-buy-a-new-gpu-blame-cryptominers-who-bought-25-of-them)
 in order to compete to solve numeric puzzles (a.k.a. “mining”).

For a while, many technologists observed that whenever the line actually goes down or a popular cryptocurrency decides to adopt a less wasteful consensus mechanism, the secondhand market gets flooded with used GPUs.

That all changed with the release of ChatGPT and other Large Language Models.

Now GPUs are a hot commodity even when the price of Bitcoin goes down because tech company leaders are either malicious or stupid, and are always trying to appease investors that have more money than sense. It’s not just tech companies either.

> “Our vision of \[quick-service restaurants\] is that an AI-first mentality works every step of the way.”
>
> [Joe Park](https://www.wsj.com/articles/taco-bell-and-pizza-hut-are-going-ai-first-yums-new-tech-chief-says-2f423d5e)
> , CEO of Yum Brands (Taco Bell, Pizza Hut, KFC)

Of all these hype cycles, I suspect that the “AI” hype has more staying power than the rest, if for no other reason than it provides a hedge against the downside of previous hype cycles.

*   Not sure to do with the exabytes of Big Data you’re sitting on? Have LLMs parse it all then convincingly lie to you about what it means.
*   Expensive cloud bill? Attract more investor dollars by selling them on trying to build an Artificial General Intelligence out of hallucinating chatbots.
*   Got a bunch of GPUs lying around from a failed crypto-mining idea? Use it to flagrantly violate intellectual property law to steal from artists with legal impunity!

This “AI” trend is the Human Centipede of technology.

![Drakeposting No Sticker](https://i0.wp.com/soatok.blog/wp-content/uploads/2021/04/soatoktelegramswave3-07.png?resize=512%2C512&ssl=1)

Art: [CMYKat](https://cmykat.carrd.co/)

So you can imagine how I felt when I went to add an image to a blog post draft one day and saw this:

![The WordPress.com add image block now has a "Generate with AI" button and no way to disable or opt out of its existence.](https://i0.wp.com/soatok.blog/wp-content/uploads/2024/07/generate-with-ai.png?resize=557%2C214&ssl=1)

Generate with AI? Fuck you.

There is no way to opt out of, or disable, this feature.

WordPress is not alone in its overt participation in this consumption of binary excrement.

### Tech Industry Idiocy is Ubiquitous

![User to Oracle's AI: "I want to delete my account".\
Oracle's AI responded with some "helpful" resources, which mostly were "how to train your model for natural language understanding" and a "knowledge search" link.\
The AI chatbot then asks "Did you find the resources helpful?" to which the user replies "No, the resources did not help"](https://i0.wp.com/soatok.blog/wp-content/uploads/2024/09/oracle.jpg?resize=571%2C595&ssl=1)

Behold, Oracle’s AI innovation

EA’s CEO called generative AI [the “very core of our business”](https://x.com/geoffkeighley/status/1836100160478138527)
, which an astute listener will find reminiscent of the time [they claimed NFTs and blockchain were the future of the games industry at an earnings call](https://www.gamedeveloper.com/business/ea-ceo-says-nfts-and-blockchain-games-are-the-future-of-our-industry-)
.

> Nevermind the fact that they’re actually in the business of publishing video games!

[Mozilla Firefox 128.0](https://www.reddit.com/r/firefox/comments/1dqngjy/privacypreserving_ad_measurement_concerns/)
 released a feature ([enabled by default of course](https://soatok.blog/2024/02/27/the-tech-industry-doesnt-understand-consent/)
) to help advertisers collect data on you.

Per 404 Media, [Snapchat reserves the right to use AI-generated images of your face in ads (also on by default)](https://www.404media.co/snapchat-reserves-the-right-to-use-ai-generated-images-of-your-face-in-ads/)
.

**At this point, even _Rip Van fucking Winkle_ can spot the pattern.**

![Powering Up Sticker](https://i0.wp.com/soatok.blog/wp-content/uploads/2021/04/soatok-telegrams-wave-3-commission-12.png?resize=512%2C512&ssl=1)

[CMYKat](https://cmykat.carrd.co/)

Investors (read: fools with more money than sense) are dead set on a generative AI future, blockchain bullshit in everything, etc. Furthermore, there are a lot of gullible idiots that drank the Kool-Aid and feel like they’re part of the build-up to the next World Wide Web, so there’s no shortage of willing new CS grads to throw at these problems to keep the money flowing.

So we’re clearly well past the point that ridiculing the people involved will have any significant deterrence. The [enshittification](https://pluralistic.net/tag/enshittification/)
 has spread too far to quarantine, and there are too many True Believers in the mix. Throw in a little bit of Roko’s Basilisk (read: Pascal’s wager for arrogant so-called “rationalists” who think they’re too smart to be Christian) and you’ve got a full-blown cargo cult on your hands.

What can we do about it? Beats me.

![](https://i0.wp.com/soatok.blog/wp-content/uploads/2021/11/soatok_stickerpack-idk.png?resize=512%2C512&ssl=1)

[CMYKat](https://cmykat.carrd.co/)

Sanity Check
------------

I’m going to set aside the [(extremely cathartic) attempts at shame and ridicule](https://www.web3isgoinggreat.com/)
 as a solution. Fun as they are, they fail to penetrate filter bubbles and reach the people they need to.

### What’s your Bullshit Tech Score?

One way we could push back against this steady march towards a future where everything is enshittified, and the devices you paid for (with your hard-earned money) [don’t respect your consent at all](https://soatok.blog/2024/02/27/the-tech-industry-doesnt-understand-consent/)
, is to turn the first of the buzz words we examined (Big Data) against these companies.

I’m proposing we could gather data about companies’ actual practices and build score-cards and leaderboards based on the following metrics:

1.  Does the company strategy involve generative AI?
2.  Does the company strategy involve selling NFTs?
3.  Does the company strategy involve stitching other unnecessary blockchain bullshit where it doesn’t belong?
4.  Does the company make questionable claims about quantum computers?
5.  Does the company choose default settings that hurt the user in the interest of increasing revenue (i.e., assuming consent without explicitly receiving it)?
6.  Does the company own any software patents?
    *   This includes purely “defensive” patents, in industries where their competitors abuse intellectual property law to stifle competition.

        While these circumstances are understandable, we should be objective in our measurements.
7.  Is the company completely bankrupt on [innovation tokens](https://boringtechnology.club/)
    ?
8.  Does the company suffer from premature optimization (e.g., choosing MongoDB because they fear a relational database isn’t web-scale, rather than because it’s the right tool for the job)?
9.  Have any of the company’s leaders been credibly accused of sexual misconduct or violence?
    *   Sorry not sorry, Blizzard!
10.  Does the company routinely have crunch time (i.e., more than one week per quarter where employees are expected to work more than 40 hours)?
11.  Does the company enforce [draconian return-to-office policies](https://soatok.blog/2023/10/02/return-to-office-is-bullshit-and-everyone-knows-it/)
    ?
12.  Has the company threatened a security researcher with lawsuits in the past 10 years?
13.  Does the company roll its own cryptography without having at least one cryptographer on the payroll?

A passing score is “No” to each of the above questions.

This proposal is basically the opposite of [SSO Tax](https://sso.tax/)
. Rather than shaming the losers (which there will assuredly be many), the goal would be to highlight companies that are **reasonably sane to work for**.

> I’m aware that there are already companies like [Forrester](https://www.forrester.com/bold)
>  that try to do this, but with a much wider scope than the avoidance of bullshit.
>
> Furthermore, they’re incentivized to **not** piss off wealthy businessmen, so that they can keep their research business alive, whereas I don’t particularly care if tech CEOs get mad at being called a hypocritical hype-huffer.
>
> I mean, what are they gonna do? _Downvote me on Hacker News?_ I don’t work for them anyway.

### In Over Our Heads

There may be other solutions available that will [improve things somewhat](https://thenib.com/mister-gotcha/)
. I’m not immune to failures of imagination.

Some solutions are incredibly contentious, though, and I don’t really want the headache.

For example: I’m sure that, if this blog post ever gets posted on a message board, someone in the peanut gallery will bring up [unions](https://code-cwa.org/organize)
 as a mechanism, and others will fiercely shoot that idea down.

It’s possible that we, as an industry, are completely in over our heads. There’s too much bullshit, and too many perverse incentives creating ever-increasing amounts of bullshit, that escape is simply impossible.

Perhaps we’ve already crossed the _excrement horizon_.

Maybe Kurzweil was right about a Singularity after all?

![Blue Screen of Death Sticker](https://i0.wp.com/soatok.blog/wp-content/uploads/2021/04/soatoktelegramswave3-10.png?resize=512%2C512&ssl=1)

[CMYKat](https://cmykat.carrd.co/)

Closing Thoughts
----------------

The main thing I wanted to convey today was, “No, you’re not alone, things _are_ getting stupider,” to anyone who wondered if there was a spark of sanity left in the tech sector.

![Soatok hugging a giant pink heart while making a blep face](https://i0.wp.com/soatok.blog/wp-content/uploads/2024/05/SoatokHeart.png?resize=512%2C512&ssl=1)

Art: [AJ](https://sfw.furaffinity.net/user/ajlovesdinos/)

It’s not _just_ the smarmy tech CEOs that are the problem. The rot has spread all the way to the foundations of many organizations. Hacker News, Lobsters, etc. are full of clueless AI maximalists that cannot see the harms they are inflicting.

> It is difficult to get a \[person\] to understand something, when \[their\] salary depends on \[their\] not understanding it.
>
> Original quote by Upton Sinclair.

Though I am at a loss for how to tackle this problem as a community, acknowledging it exists is still important to me.

### On WordPress and Generative AI

Years ago, I wrote on Medium, but got tired of the constant [pressure to monetize my blog](https://soatok.blog/2024/07/02/my-furry-blog-is-not-an-opportunity-to-develop-your-brand/)
, so I decided to pay for a WordPress.com account. [I write for myself](https://soatok.blog/2024/09/09/doesnt-matter/)
, after all, and don’t expect any compensation for it.

> Many of you will notice the “[adblocker not detected](https://github.com/stefanbohacek/detect-missing-adblocker)
> ” popup. That sums up how I feel about the adtech industry.

It’s disheartening that WordPress is pushing Generative AI bullshit to paying customers with no way to opt out of the feature. (Nevermind that it should be [off-by-default and opted into](https://soatok.blog/2024/02/27/the-tech-industry-doesnt-understand-consent/)
.)

For now, I just refuse to use the feature and hope a lower adoption rate causes a project manager somewhere in Automattic to sweat. They’re somewhat notorious for being led by stubborn assholes who don’t listen to critics (even on security matters).

I’ll also continue to credit the artists that made the furry art I include in my blog posts, because supporting artists is the exact opposite of supporting generative AI.

If you’re looking for a furry artist to commission, first [read this](https://soatok.blog/2020/10/16/commission-prices-for-furries-and-artists/)
, and then maybe consider the artists whose work I’ve featured over the years.

### New Avenues of Bullshit

If I may be so bold as to make a predication: In the distant future, I expect to see more Quantum Computing related bullshit.

Though currently constrained to [the realm of grifters](https://quackers.blog/2024/01/29/is-orion-by-crown-sterling-legit-nope/)
, NIST’s recent standardization of post-quantum cryptography is likely to ignite a lot of questionable technology companies.

Whether any of this quantum bullshit catches on at the same scale as tech industry hype remains to be seen.

If any does, I promise to handle each instance with the same derision as [the bullshit I discovered in DFECON’s Quantum Village](https://soatok.blog/2023/08/20/defcon-quantum-village-2-electric-boogaloo/)
.

*   Tags [Cryptocurrency](https://soatok.blog/tag/cryptocurrency/)
    , [Society](https://soatok.blog/tag/society/)
    , [Technology](https://soatok.blog/tag/technology/)

![](https://secure.gravatar.com/avatar/146676f54771c654ed4b7e59e7513974?s=160&d=identicon&r=g)

By Soatok
---------

Security engineer with a fursona. Ask me about dholes or Diffie-Hellman!

The Continued Trajectory of Idiocy in the Tech Industry - Dhole Moments

This is a long form article, you can read it in https://habla.news/a/naddr1qvzqqqr4gupzpdens7rzx0w8yxjfvzy83muzujt7emh5j54kw5erwn6mk87mt0lnqqzrzve5x5a6d0xu


Big thanks to the Amethyst devs for clearly explaining how each of the relay types function /serious

💪🏼