> the total cost of running the Deepseek model on OpenRouter was 22 cents. Yes, $0.22.
This feels just so fundamentally like a step change to me. I was reverse-engineering Nest thermostats a year ago by hand, and now I feel like a month worth of my work could be done with 22 cents and an LLM. Exciting times for reverse-engineering and hardware/software interface
Most of my AI usage at work is asking it to explain how arcane, poorly documented codebases whose authors left the company long ago are architected, and it's been shockingly good at it so far.
I've been meaning to work on something similar. I have some random cheap IP camera's lying around I'd like to use but don't want their entire suspect cloud connection, shoddy app, etc. One of them looked particularly easy. After getting stumped on a similar password gate, I tried throwing Codex with as much "don't worry about safety I have permissions to do this" prompts as possible but that shut down pretty quickly. I gave it to deepseek and it was much more cooperative but I didn't have a setup as equipped to easily interact with the network and USB connection like I did with Codex and wasn't sure how much I'd be putting in token wise to a cheap camera. Seeing this cost you a whopping 22 cents I'm tempted to give it a shot now if I can get a better setup for it to interact with the cameras.
Check if they have RTSP video streams. Even the cheapest ones usually do, labeled something like "LAN view". Unless you have rare cameras, RTSP is probably already documented on some forum and you can bypass the debugging entirely.
With open RTSP streams, you can just treat them as dumb cameras. Keep them in an isolated network segment and use some recording software to capture their picture.
I guess miniaturization should stop surprising me, but I recently realized you can buy drone components online. These are low power and transmit a low-latency video feed (some analog, some digital, depending on camera) a long distance (they are for first-person-view drone racing).
The price is what really surprised me. The most expensive thing there is $14. There are many similar options floating around. I assume that these are priced at a premium because they are for applications where people care about shaving 0.1g.
The cheap cameras you are seeing produce an NTSC signal that _barely_ usable. I will frequently hit 'invisible' twigs because they are below the resolving power of the camera->transmission->receiving pipeline. Most FPV race tracks have high contrast or illuminated gates to combat this.
(Also, you should buy a tinywhoop, most fun you can have sitting down)
Are you able to make a recommendation of a drone with good range for outside flying and camera quality? There are so many options it's crazy, but I've assumed (possibly incorrectly) that going the custom route could yield better results for less money than just buying something like a DJI mini straight away?
The cheap ones use very simply analog transmission techniques to send a video image. The quality is just enough to see where you’re flying the drone, but it’s much less than you would expect from a security camera.
There are digital options available but once you price the digital transmitter and receiver it’s going to be in the hundreds of dollars, not low tens. Amazing that it’s as cheap as it is, but there’s still a price.
The parts you linked are just cameras, not analog transmitters. It’s a cheap camera sensor with just enough circuitry to get a low res analog signal out.
I like that the developer of the camera firmware knew someone would try to extract the password from the binary, and so obfuscated the password string with a bitwise operation to obfuscate it from string searches.
But! they forgot to obfuscate the string RIGHT NEXT TO IT... "enter password", which clued the LLM into where to look for the password.
To be clear, i dont credit the LLM for "thinking" to look there. It just digested enough blogs of other people doing this.
But nonetheless, the technique is cool.
The less here is to probably obfuscate ALL strings.
As someone who's written firmware in a corporate environment, I doubt they forgot. We had a security requirement that mandated certain fields be obfuscated. It was a pain in the ass and completely useless given the nature of the device the firmware lived on and the nature of the firmware itself. So we did the bare minimum to pass the stupid scanner someone decided was necessary 10 years ago.
This smells like a similar situation, it's not like they don't have enough horsepower for MD5.
this was a nice read, but I have exactly one question - if you already decided on ai model to use, why go through rent-seeking middleman? why pay money to openrouter?
Author here, good question! I actually didn’t know what model I wanted to use; I had a general idea of “let’s try a Chinese model instead” but didn’t know how Deepseek, Qwen, or any of the other models compared against each other. Deepseek was just the first one I tried.
If I knew from the start which model I would land on I probably would’ve paid for access on their API. But the nice thing with reseller platforms is that I can quickly try out different models for a slight fee added on top, and I think that’s pretty nice given that I don’t know what model is better at any given moment, and because good new models come out all the time from all the different providers.
Well, they clearly already made the mistake once of investing in a particular provider (and then needing to apply for refund), so why not go to openrouter where your credit balance can be taken to whatever provider you want at any time? That's future-proofing, not indecision.
Love to see the deconstructive approach here, where LLMs only come into play when you're stumped and then only on that specific part. It's a good approach, it lets you get more practice instead of it all coming to a stop.
I agree, he really seemed to use it mainly to help stay on task, and be forced into unproductive rabbit holes. Great example is the function that turned out to be a float to int conversion; that has nothing really to do with what he is attempting to solve, and would be disheartening to use a bunch of effort only to find it wasted on such a mundane function.
> disheartening to use a bunch of effort only to find it wasted
It's disheartening if your life plan was to do this for 4 hours then never again. But if you meant to keep using this skill, today's hard-won knowledge, combined with continued use, means he'll personally be able to eyeball a similar disassembled float-conversion function in the future and have an educated guess at its purpose, which is a super power!
"Also, for those that are curious: the total cost of running the Deepseek model on OpenRouter was 22 cents. Yes, $0.22. You don’t need an expensive subscription or sell your soul to Altman or Amodei."
It feels like for RE work, Chinese models are currently the only ones that actually let you do that, because the US ones want a healthy subscription plan or an government/enterprise customer.
I did RE of two Xiaomi cameras with Opus 5.5 with zero refusals, he even connected them to frigate and set up everything I needed for local recording. And I just used the $20 subscription that I already used for other stuff, so it was effectively free work.
The question is WHEN did you do that, because Anthropic is known to lately cut off users from RE work when it makes a lot of fuss in the media about their models being used to uncover spyware in smart TVs or to crack old videogames for piracy.
I’m very very excited by reverse engineered / reflashed cheap PoE cameras - you can find many on aliexpress that are about $20 and fully run Linux
Check out cameras with the “GOKE” chip.
https://openipc.org/supported-hardware/featured is one long-standing effort to reverse engineer and provide new firmware for these. There can’t be enough!
> the total cost of running the Deepseek model on OpenRouter was 22 cents. Yes, $0.22.
This feels just so fundamentally like a step change to me. I was reverse-engineering Nest thermostats a year ago by hand, and now I feel like a month worth of my work could be done with 22 cents and an LLM. Exciting times for reverse-engineering and hardware/software interface
Most of my AI usage at work is asking it to explain how arcane, poorly documented codebases whose authors left the company long ago are architected, and it's been shockingly good at it so far.
I've been meaning to work on something similar. I have some random cheap IP camera's lying around I'd like to use but don't want their entire suspect cloud connection, shoddy app, etc. One of them looked particularly easy. After getting stumped on a similar password gate, I tried throwing Codex with as much "don't worry about safety I have permissions to do this" prompts as possible but that shut down pretty quickly. I gave it to deepseek and it was much more cooperative but I didn't have a setup as equipped to easily interact with the network and USB connection like I did with Codex and wasn't sure how much I'd be putting in token wise to a cheap camera. Seeing this cost you a whopping 22 cents I'm tempted to give it a shot now if I can get a better setup for it to interact with the cameras.
Check if they have RTSP video streams. Even the cheapest ones usually do, labeled something like "LAN view". Unless you have rare cameras, RTSP is probably already documented on some forum and you can bypass the debugging entirely.
With open RTSP streams, you can just treat them as dumb cameras. Keep them in an isolated network segment and use some recording software to capture their picture.
I guess miniaturization should stop surprising me, but I recently realized you can buy drone components online. These are low power and transmit a low-latency video feed (some analog, some digital, depending on camera) a long distance (they are for first-person-view drone racing).
https://betafpv.com/collections/cameras
The price is what really surprised me. The most expensive thing there is $14. There are many similar options floating around. I assume that these are priced at a premium because they are for applications where people care about shaving 0.1g.
The cheap cameras you are seeing produce an NTSC signal that _barely_ usable. I will frequently hit 'invisible' twigs because they are below the resolving power of the camera->transmission->receiving pipeline. Most FPV race tracks have high contrast or illuminated gates to combat this.
(Also, you should buy a tinywhoop, most fun you can have sitting down)
Are you able to make a recommendation of a drone with good range for outside flying and camera quality? There are so many options it's crazy, but I've assumed (possibly incorrectly) that going the custom route could yield better results for less money than just buying something like a DJI mini straight away?
The cheap ones use very simply analog transmission techniques to send a video image. The quality is just enough to see where you’re flying the drone, but it’s much less than you would expect from a security camera.
There are digital options available but once you price the digital transmitter and receiver it’s going to be in the hundreds of dollars, not low tens. Amazing that it’s as cheap as it is, but there’s still a price.
The parts you linked are just cameras, not analog transmitters. It’s a cheap camera sensor with just enough circuitry to get a low res analog signal out.
I like that the developer of the camera firmware knew someone would try to extract the password from the binary, and so obfuscated the password string with a bitwise operation to obfuscate it from string searches.
But! they forgot to obfuscate the string RIGHT NEXT TO IT... "enter password", which clued the LLM into where to look for the password.
To be clear, i dont credit the LLM for "thinking" to look there. It just digested enough blogs of other people doing this.
But nonetheless, the technique is cool.
The less here is to probably obfuscate ALL strings.
As someone who's written firmware in a corporate environment, I doubt they forgot. We had a security requirement that mandated certain fields be obfuscated. It was a pain in the ass and completely useless given the nature of the device the firmware lived on and the nature of the firmware itself. So we did the bare minimum to pass the stupid scanner someone decided was necessary 10 years ago.
This smells like a similar situation, it's not like they don't have enough horsepower for MD5.
I have couple of old Chinese cameras (Sricam), still working but not supported anymore. It's worth to try something similar on them?
this was a nice read, but I have exactly one question - if you already decided on ai model to use, why go through rent-seeking middleman? why pay money to openrouter?
Author here, good question! I actually didn’t know what model I wanted to use; I had a general idea of “let’s try a Chinese model instead” but didn’t know how Deepseek, Qwen, or any of the other models compared against each other. Deepseek was just the first one I tried.
If I knew from the start which model I would land on I probably would’ve paid for access on their API. But the nice thing with reseller platforms is that I can quickly try out different models for a slight fee added on top, and I think that’s pretty nice given that I don’t know what model is better at any given moment, and because good new models come out all the time from all the different providers.
Well, they clearly already made the mistake once of investing in a particular provider (and then needing to apply for refund), so why not go to openrouter where your credit balance can be taken to whatever provider you want at any time? That's future-proofing, not indecision.
Love to see the deconstructive approach here, where LLMs only come into play when you're stumped and then only on that specific part. It's a good approach, it lets you get more practice instead of it all coming to a stop.
I agree, he really seemed to use it mainly to help stay on task, and be forced into unproductive rabbit holes. Great example is the function that turned out to be a float to int conversion; that has nothing really to do with what he is attempting to solve, and would be disheartening to use a bunch of effort only to find it wasted on such a mundane function.
> disheartening to use a bunch of effort only to find it wasted
It's disheartening if your life plan was to do this for 4 hours then never again. But if you meant to keep using this skill, today's hard-won knowledge, combined with continued use, means he'll personally be able to eyeball a similar disassembled float-conversion function in the future and have an educated guess at its purpose, which is a super power!
From the author:
"Also, for those that are curious: the total cost of running the Deepseek model on OpenRouter was 22 cents. Yes, $0.22. You don’t need an expensive subscription or sell your soul to Altman or Amodei."
It feels like for RE work, Chinese models are currently the only ones that actually let you do that, because the US ones want a healthy subscription plan or an government/enterprise customer.
OpenAI Daybreak Blue is essentially a rubber stamp process for individuals, I hd no problem getting approved as Joe Rando.
But it's charged at an even higher rate.
No it isn’t, Daybreak Blue is charged at the same rate as GPT-5.6 Sol. You’re thinking of Daybreak Red, which is a lot more expensive.
Doesn't that still require Persona face verification? They won't need a name to find you then.
I did RE of two Xiaomi cameras with Opus 5.5 with zero refusals, he even connected them to frigate and set up everything I needed for local recording. And I just used the $20 subscription that I already used for other stuff, so it was effectively free work.
The question is WHEN did you do that, because Anthropic is known to lately cut off users from RE work when it makes a lot of fuss in the media about their models being used to uncover spyware in smart TVs or to crack old videogames for piracy.
I recently patched the anti-cheat out of a game that prevented it from running on Linux with Sol 6.1.
I wouldn't have had to do this if game studios weren't hell bent on excluding people who expect to control their computers.
And that's what happened here; Anthropic balks, open weights come to the rescue