Using Artificial Intelligence to reverse engineer hardware · Christian F.K. Schaller · blogs.gnome.org, October 15, 2026
A recorded reference session gave Claude a diff to work from on two hardware drivers
Schaller set out to write a SANE scanner backend for the Plustek OpticFilm 8200i, whose newer chipset Linux did not support. He says he got "nowhere for the longest time" with Claude and gave up for a few months. What changed was a setup, borrowed from a post by Tom Crider (Glorious Eggroll), in which the agent controls a Windows virtual machine running the vendor driver while USB traffic is captured. He reports a first working scan within hours and a near-perfect driver some days later. He credits the capture setup and, "probably", improvements to Claude Code. He then reused the setup on the camera in his ThinkPad X1 Carbon Gen 14 (Aura Edition) and reports kernel and libcamera patches by the end of one day.
The published hw-harness (MIT, shell and PowerShell) generalizes the scripts he used; he says he did not run it in this form. The loop: run the vendor driver in a KVM guest with the device passed through, record the traffic with usbmon on the host, repeat the operation with the Linux driver, and diff the two traces. For the internal camera, which has no bus to tap, it reads INF files, registry data and ACPI tables instead. Schaller says the captures turn "a vague 'it doesn't work'" into "a concrete list of differences".
His camera write-up lists five defects, three in the kernel sensor driver and two in libcamera's software ISP, and reports a low-light comparison against a stock Fedora 44 install: frame brightness 31.1 to 90.9, red/green 0.890 to 1.047 and blue/green 0.672 to 0.823, against a USB webcam reference of 1.052 and 0.989. Blue remains about 17% short in low light, and he says the camera is not perfect. For the scanner he reports a full-resolution scan in 34.6 seconds against 54.4 for the upstream backend, which gained support for the same scanner in September; he calls these single-unit, single-frame results. The kernel patches are submitted and the libcamera patches are under review, and all measurements are the author's own on one machine and one scanner.
Why it matters: The agent's progress followed the evidence it was given. A recording of known-good behavior from the same instrument turned an open-ended debugging task into a comparison with an answer. If you hand an agent a task with no oracle, build the oracle first: a reference run, a captured trace, a diff. Schaller's own account does not separate the effect of the harness from the effect of newer model versions, so treat the size of the gain as unmeasured.