Marcus Folkesson

Embedded Linux Artist

Rooting a VMC2040 security camera part 2: Extract the firmware

Rooting a VMC2040 security camera part 2: Extract the firmware Brief As there were no exposed vulnerabilities via UART (no TX, only RX) or network (no open ports that could be exploited), I decided to extract the firmware from the SPINAND flash. This part of the series is about the process of extracting the firmware and analyzing it. The other parts of the series are: Part1: Basic examination Part2: Extract the firmware Part3: Analyse boot sequence Part4: Deeper analysis Part5: What didn't work Part6: What did work Part7: Conclusion and summary Extract the firmware I have a XGECU-T48 programmer for such tasks.

cover

Posted by Marcus Folkesson on Thursday, May 7, 2026

Rooting a VMC2040 security camera part 1: Basic examination

Rooting a VMC2040 security camera part 1: Basic examination Brief My friend had a Arlo VMC2040 security camera [1] on his shelf. He bought it a while ago, but never really used it as it required a subscription to work properly. The only feature that he wanted was to get the video stream out from the camera without any cloud involvement, but that was unfortunately not possible. Here in Sweden we have a long holiday due to Easter, so I decided to take a look at the camera and see what's possible.

cover

Posted by Marcus Folkesson on Thursday, May 7, 2026

TIL - DNS queries with multiple interfaces

TIL - DNS queries with multiple interfaces TIL, Today I Learned, is more of a "I just figured this out: here are my notes, you may find them useful too" rather than a full blog post I must admin that I'm not one of those network gurus that knows everything about every protocol out there and how they work. But I have a pretty good understanding how things works, or at least that's what I tell myself :-)

cover

Posted by Marcus Folkesson on Thursday, March 26, 2026

Tracing function calls in C with -finstrument-functions

Tracing Function Calls in C with -finstrument-functions Some time ago, I wrote a blog post about mutex guards in the Linux kernel [1]. It uses a cool feature in GCC which allows you to cleanup resources when they go out of scope. I have a few of such GCC features that I use every now and then, which often show itself handy in the most unexpected way. -finstrument-functions is one of those.

cover

Posted by Marcus Folkesson on Thursday, March 19, 2026

Reverse engineer a serial key validator

Reverse engineer a serial key validator A bit of nostalgia As many kids in my generation, I grew up with video games and the big question was always "Who is gonna be the host for the LAN party this weekend?". Same question. Every. Single. Weekend. This was in late 90s, and we were about 10-12 years old, so we did not have a lot of money. We were lucky to have network equipment (mostly cables, switches, hubs.

cover

Posted by Marcus Folkesson on Wednesday, February 11, 2026

Shrink disk images

Shrink disk images Brief I wanted to shrink a raw disk image file I had that contained multiple partitions. Nothing unusual at all. I thought there should be multiple tools out there to do this (and I'm sure there are), but the first couple of Google results were just showing some old GUI tools - which I refuse to use. Instead of searching further, I decided to "just do it".

cover

Posted by Marcus Folkesson on Thursday, January 29, 2026

Naming your serial ports with udev

Naming your serial ports with udev Brief UART is still a very common way to communicate with embedded systems, in fact, I would say that it is the most common way. When looking around in my lab, I can see that I have four different development boards/projects connected via UART to my computer. Two of them even use more than one port. My point is that when you have many serial ports connected to your computer, it can be hard to keep track of which port is which.

cover

Posted by Marcus Folkesson on Monday, January 19, 2026

Remotely controlled USB hub

Remotely controlled USB hub This is no fancy project, but I thought it might be useful for someone out there. There is probably better ways to do this, but this is what I came up with. My situation For those who haven't read my previous post [1], I have recently bought two (yes, TWO!) Rigol DP832 power supplies to power my lab equipment. (I really love them and will never use a non-programmable power supply without ethernet interface again.

cover

Posted by Marcus Folkesson on Saturday, January 17, 2026

GNSS spoofing using SDR

GNSS spoofing using SDR First of all, sending false GNSS signals on the air is illegal in most countries. You must have a controlled RF environment (Faraday cage or such) to perform GNSS spoofing experiments. A box covered with aluminum foil with copper tape in all joints works quite well, but be sure everything (holes for cables, joints etc) are properly shielded. The best is to not transmit to open air at all, but using coax cables only.

cover

Posted by Marcus Folkesson on Thursday, January 15, 2026

Using AI to write me a tool

Using AI to write me a tool Brief This is my first attempt at using claude-sonnet-4.5 to help me write code using Github copilot. I recently bought a Rigol DP832 programmable power supply [1] , which is actually a very nice piece of hardware for the price. The sad truth is that the main reason for buying it was that my old PSU is quite noisy, and I thought that a newer one would be quieter.

cover

Posted by Marcus Folkesson on Friday, December 19, 2025