I've been meaning to work on something similar. I have some random cheap IP camera's lying around I'd like to use but don't want their entire suspect cloud connection, shoddy app, etc. One of them looked particularly easy. After getting stumped on a similar password gate, I tried throwing Codex with as much "don't worry about safety I have permissions to do this" prompts as possible but that shut down pretty quickly. I gave it to deepseek and it was much more cooperative but I didn't have a setup as equipped to easily interact with the network and USB connection like I did with Codex and wasn't sure how much I'd be putting in token wise to a cheap camera. Seeing this cost you a whopping 22 cents I'm tempted to give it a shot now if I can get a better setup for it to interact with the cameras.
this was a nice read, but I have exactly one question - if you already decided on ai model to use, why go through rent-seeking middleman? why pay money to openrouter?
Author here, good question! I actually didn’t know what model I wanted to use; I had a general idea of “let’s try a Chinese model instead” but didn’t know how Deepseek, Qwen, or any of the other models compared against each other. Deepseek was just the first one I tried.
If I knew from the start which model I would land on I probably would’ve paid for access on their API. But the nice thing with reseller platforms is that I can quickly try out different models for a slight fee added on top, and I think that’s pretty nice given that I don’t know what model is better at any given moment, and because good new models come out all the time from all the different providers.
Well, they clearly made the mistake of investing in a particular provider once (and then needing to apply for refund), so why not go to openrouter where your credit balance can be taken to whatever provider you want at any time? It's future-proofing, not indecision.
"Also, for those that are curious: the total cost of running the Deepseek model on OpenRouter was 22 cents. Yes, $0.22. You don’t need an expensive subscription or sell your soul to Altman or Amodei."
It feels like for RE work, Chinese models are currently the only ones that actually let you do that, because the US ones want a healthy subscription plan or an government/enterprise customer.
I did RE of two Xiaomi cameras with Opus 5.5 with zero refusals, he even connected them to frigate and set up everything I needed for local recording. And I just used the $20 subscription that I already used for other stuff, so it was effectively free work.
Love to see the deconstructive approach here, where LLMs only come into play when you're stumped and then only on that specific part. It's a good approach, it lets you get more practice instead of it all coming to a stop.
I agree, he really seemed to use it mainly to help stay on task, and be forced into unproductive rabbit holes. Great example is the function that turned out to be a float to int conversion; that has nothing really to do with what he is attempting to solve, and would be disheartening to use a bunch of effort only to find it wasted on such a mundane function.
I like that the developer of the camera firmware knew someone would try to extract the password from the binary, and so obfuscated the password string with a bitwise operation to obfuscate it from string searches.
But! they forgot to obfuscate the string RIGHT NEXT TO IT... "enter password", which clued the LLM into where to look for the password.
To be clear, i dont credit the LLM for "thinking" to look there. It just digested enough blogs of other people doing this.
But nonetheless, the technique is cool.
The less here is to probably obfuscate ALL strings.
I've been meaning to work on something similar. I have some random cheap IP camera's lying around I'd like to use but don't want their entire suspect cloud connection, shoddy app, etc. One of them looked particularly easy. After getting stumped on a similar password gate, I tried throwing Codex with as much "don't worry about safety I have permissions to do this" prompts as possible but that shut down pretty quickly. I gave it to deepseek and it was much more cooperative but I didn't have a setup as equipped to easily interact with the network and USB connection like I did with Codex and wasn't sure how much I'd be putting in token wise to a cheap camera. Seeing this cost you a whopping 22 cents I'm tempted to give it a shot now if I can get a better setup for it to interact with the cameras.
this was a nice read, but I have exactly one question - if you already decided on ai model to use, why go through rent-seeking middleman? why pay money to openrouter?
Author here, good question! I actually didn’t know what model I wanted to use; I had a general idea of “let’s try a Chinese model instead” but didn’t know how Deepseek, Qwen, or any of the other models compared against each other. Deepseek was just the first one I tried.
If I knew from the start which model I would land on I probably would’ve paid for access on their API. But the nice thing with reseller platforms is that I can quickly try out different models for a slight fee added on top, and I think that’s pretty nice given that I don’t know what model is better at any given moment, and because good new models come out all the time from all the different providers.
Well, they clearly made the mistake of investing in a particular provider once (and then needing to apply for refund), so why not go to openrouter where your credit balance can be taken to whatever provider you want at any time? It's future-proofing, not indecision.
From the author:
"Also, for those that are curious: the total cost of running the Deepseek model on OpenRouter was 22 cents. Yes, $0.22. You don’t need an expensive subscription or sell your soul to Altman or Amodei."
It feels like for RE work, Chinese models are currently the only ones that actually let you do that, because the US ones want a healthy subscription plan or an government/enterprise customer.
OpenAI Daybreak Blue is essentially a rubber stamp process for individuals, I hd no problem getting approved as Joe Rando.
I did RE of two Xiaomi cameras with Opus 5.5 with zero refusals, he even connected them to frigate and set up everything I needed for local recording. And I just used the $20 subscription that I already used for other stuff, so it was effectively free work.
Love to see the deconstructive approach here, where LLMs only come into play when you're stumped and then only on that specific part. It's a good approach, it lets you get more practice instead of it all coming to a stop.
I agree, he really seemed to use it mainly to help stay on task, and be forced into unproductive rabbit holes. Great example is the function that turned out to be a float to int conversion; that has nothing really to do with what he is attempting to solve, and would be disheartening to use a bunch of effort only to find it wasted on such a mundane function.
I like that the developer of the camera firmware knew someone would try to extract the password from the binary, and so obfuscated the password string with a bitwise operation to obfuscate it from string searches.
But! they forgot to obfuscate the string RIGHT NEXT TO IT... "enter password", which clued the LLM into where to look for the password.
To be clear, i dont credit the LLM for "thinking" to look there. It just digested enough blogs of other people doing this.
But nonetheless, the technique is cool.
The less here is to probably obfuscate ALL strings.