A Monitor's Firmware, Cracked Twice: Human and AI Both Took 15 Minutes

Forum topic · 小凯 · 2026-10-11

Summary

A recent experiment by security researcher Low Level shows how quickly encrypted monitor firmware can be reverse engineered. The Dell S3422's firmware, distributed in an encrypted UPG format that defeats Binwalk scanning, was cracked manually in about 15 minutes using standard techniques: entropy analysis to locate encrypted regions, then finding the decryption routine and key inside the firmware itself. The same task was then handed to GLM 5.3, which also completed it in roughly 15 minutes, plus 45 seconds to verify MD5 and message authentication codes. Notably, the model identified that the firmware runs on an Mstar 8051 core and located the reset vector and function pointer table, meaning it understood the program's structure rather than treating it as noise. The author argues that while the lowest rung of reverse engineering (unpacking encrypted firmware) is now effectively solved, finding unknown vulnerabilities remains unsolved—yet the steepest barrier, decrypting and reading raw code, has collapsed from a years-long expert skill to a single AI conversation. The piece closes with practical advice: vendors should move keys into hardware ROM, abandoning security-by-obscurity.

Your Monitor Is a Computer

An easily overlooked fact: your monitor is a computer. It has its own processor, memory, and firmware—scaling algorithms, color temperature curves, OSD menus, and HDMI switching logic all run on that small chip. Every time you press the menu button, you're navigating an embedded system.

Vendors don't really want you studying this system. Monitor makers like Dell ship firmware packages in encrypted formats, so running Binwalk (the standard firmware unpacking tool) over them yields only unrecognized data blocks. Security researcher Low Level recently hit exactly this wall: the firmware of an S3422 monitor, in UPG format, encrypted.

Cracking It by Hand: 15 Minutes

He cracked it in about fifteen minutes. Each step of the process is worth spelling out:

1. Entropy analysis — Divide the firmware into small blocks and measure how "random" each one is. Code segments have regular byte patterns; compressed and encrypted data is near-total randomness with strikingly high entropy. One entropy plot, and the encrypted regions are obvious. 2. Locating the decryption method — The encryption algorithm must be executable inside the firmware, so the decryption code usually lives in the firmware itself. Find it, follow the thread, and you find the key.

The UPG format opened up. This isn't a rare trick—it's standard firmware reverse engineering craft. The fifteen minutes reflect years of experience on the author's part.

Handing the Same Task to GLM 5.3

The same task went to GLM 5.3. Same fifteen minutes to break the flash image's encryption, then forty-five seconds to verify MD5 hashes and message authentication codes, confirming the decrypted data was correct.

More interesting followed: GLM 5.3 recognized the firmware runs on an Mstar 8051 core, and identified the reset vector and the function pointer table.

For those unfamiliar with embedded systems: the 8051 is an 8-bit microcontroller architecture designed in the 1970s that still serves in countless monitors, appliances, and peripherals because it's sufficient, cheap, and has a mature licensing chain. The reset vector is the address where the chip fetches its first instruction after power-on—find it and you've found the program's entry point. The function pointer table is the firmware's directory of "where to jump next." An AI recognizing both in a stream of hex means it wasn't reading garbage—it was reading a program's skeleton.

Has AI Solved Reverse Engineering?

The answer isn't a simple yes or no. Reverse engineering was never one thing but a whole spectrum:

Lowest rung — "unpack this firmware package": solved. Cracked once by a human, once by an AI, both in fifteen minutes.
Upper reaches — "find a vulnerability nobody knows about in this firmware": not solved.
The steepest middle threshold — stripping encryption and reading raw code structure: its height has dropped from "years of practiced skill" to "one conversation."

This threshold has been dropping for a while. Ghidra went open source in 2019, putting a world-class reverse engineering analyzer in everyone's hands; DEF CON talks demonstrated monitor firmware being hijacked into backdoors years ago—then still a lab-grade, hardcore feat. Now it's conversational models' turn. Every step does the same thing: turning "what only experts could do" into "what many people can do."

Consequences and the Vendor's Only Real Fix

The consequences are almost textbook. Once the threshold flattens, vulnerabilities don't multiply out of thin air—but *seen* vulnerabilities certainly multiply, because the number of people looking into firmware goes from dozens to tens of thousands.

Low Level's advice to vendors in the video is practical: burn keys into ROM so they never travel inside user-facing firmware packages, rather than relying on the encryption format itself as a barrier. In other words, once "security through obscurity" is dismantled, only one path remains—move the root of trust into hardware, keeping decryption capability out of the attacker's reach from the start.

An encrypted firmware package stops Binwalk's pattern matching. It doesn't stop a chat window that reads entropy plots and recognizes an 8051 skeleton. The next monitor firmware release will face not just users waiting to upgrade, but anyone curious enough to look—and any model ready to answer their every question.

---

*Source note: video details verified via YouTube oembed ("Has AI Solved Reverse Engineering?" · Low Level · 2026-10-09); process details (Binwalk entropy analysis, UPG, Mstar 8051, MD5/MAC verification, key-in-ROM recommendation) per the video's narration; GLM 5.3, Dell S3422, and 8051 architecture background verified against public sources; "A Monitor Darkly" is the common reference for the DEF CON 24 (2016) monitor firmware security research.*