# FNIRSI 2C53T oscilloscope: ripcord Firmware Analysis Pipeline

> Source: <https://reversedwithai.com/p/fnirsi-2c53t-oscilloscope-f60cd393>
> Published: 2026-10-25 12:31:13+00:00

## Evidence at a glance

Based on the linked sources. The author's reported result and independent confirmation are separate checks.

- AI involvement
- Reported models: Claude. Tools: Ghidra, Renode, Unicorn, DuckDB, Snakemake, Claude Code. The writeup below describes the work attributed to AI.
- Reported result
- Works. This is the directory's source-based outcome classification.
- Independent confirmation
- Not reported.
- Human work and limitations
- The project explicitly distinguishes between static analysis and execution-verified claims. The author notes that while some FPGA-boundary facts were initially 'not-exec-verified', subsequent runs in the Renode oracle promoted these to verified status.

### Original sources

## What was done

ripcord is a research pipeline that transforms opaque embedded firmware into a structured, queryable database of facts. It uses deterministic tools for extraction and execution-based verification, with Claude Code acting as the primary driver for analysis and comprehension.

ripcord is a research pipeline designed to reverse engineer embedded firmware by converting opaque binaries into a structured warehouse of facts, including functions, call graphs, and MMIO access patterns. Unlike tools that rely on context-free decompilation, ripcord builds a queryable context first. The pipeline utilizes deterministic tools for extraction, classification, and recovery, while reserving LLM budget for residue that cannot be resolved mechanically. A core principle is that execution serves as the verification oracle; claims are confirmed by running or tracing code in Unicorn or Renode, ensuring logic is verified rather than just statically analyzed. Claude Code drives the process, utilizing custom skills and CLI tools to interact with the warehouse. The project documents a transition from scripted agent swarms to a harness where Claude Code manages the analysis, with an optional MCP server for interop. The author reports successful blind recovery on stripped binaries and execution-verified protocol specifications for the FNIRSI 2C53T oscilloscope, including its FPGA acquisition path. [Source](https://raw.githubusercontent.com/davidclawson/ripcord/HEAD/README.md)

## Reproduce it

```
See SETUP.md for toolchain prerequisites. Run scripts/ripcord.py on a target binary to generate the warehouse, then use scripts/query or Claude Code to analyze the resulting Parquet tables.
```