Using AI to Reverse Engineer Hardware Drivers with hw-harness

AI-Assisted Driver Development Workflow

Christian F.K. Schaller described how he used Claude to reverse engineer hardware drivers by combining AI tooling with a structured capture and comparison workflow. After seeing how others used AI agents with full control of Windows virtual machines, he built a generic harness to automate the process. The key insight is that the AI model excels at decoding captures, writing probes, and cross-checking constants, tasks that traditionally take weeks of manual effort.

How hw-harness Works

The harness runs the vendor's Windows driver in a KVM virtual machine with the device passed through to the guest. Traffic is recorded on the Linux host using usbmon, which sits below the passthrough layer so the guest cannot detect it. The same operation is then repeated on Linux with the custom driver and captured the same way. The two traces are diffed to produce a concrete list of driver bugs. For devices without a bus to tap, such as internal MIPI cameras, the harness uses Windows-side inspection of INF files, registry data, ACPI tables, and device properties. The approach does not rely on copying code; every constant in the new driver traces back to recorded behavior.

Three Projects Completed

The first project produced a SANE backend for the Plustek OpticFilm 8200i film scanner, which uses a Genesys GL128 controller and previously had no Linux support. The backend supports color, gray, and infrared modes at resolutions up to 7200 dpi, along with dust and scratch removal. At 3600 dpi it completed scans in 34.6 seconds compared to 54.4 seconds for the upstream genesys backend, which gained support for this scanner in September 2026. Both resolve the same fine detail. The backend is packaged as a Fedora RPM.

The second project is Negative Vibes, a GNOME application written in Rust for scanning negatives and slides on any film-capable SANE scanner. It preserves the raw 16-bit linear scan with infrared data and applies non-destructive inversion, calibration through ArgyllCMS, and export to TIFF, JPEG, PNG, and DNG. It ships as a Flatpak that includes the scanner backend.

The third project fixed MIPI camera issues on a Lenovo ThinkPad X1 Carbon Gen 14 with a Sony IMX471 sensor. The kernel patches addressed a crop-selection bug, a wrong test-pattern register width, and an analogue gain cap that cost about 1.8 stops of sensitivity. The libcamera software ISP patches added missing lens shading correction that had left corners 2.7 stops darker and fixed white-balance statistics that were summed at native bit depth against an 8-bit black level. In a controlled low-light test, frame brightness rose from 31.1 to 90.9 and color ratios moved significantly closer to a USB webcam reference. Kernel patches have been submitted and libcamera patches are under review.

Key Lessons

Schaller noted that reference captures are a major advantage, having the AI compare a known-good trace against a failing one turns a vague problem into a concrete list of differences. The AI handles the tedium of decoding and probing, but real hardware remains the only judge. He encourages anyone with unsupported hardware to try the hw-harness approach.

Sources: blogs.gnome.org