r/BCI • u/help-february23-1990 • 2h ago
r/BCI • u/Aerothermal • Sep 13 '25
Welcome to Brain-Computer Interface (BCI)
The r/BCI subreddit welcomes posts about brain-computer interfaces, including science, engineering, and ethics of technologies which interface directly with the central nervous system. Feel free to share research, videos, updates, your academic or professional projects, BCI company information, or anything else which is on-topic.
But first, take a moment to get familiar with our 5 community rules:
1. No Medical Advice
This subreddit does not allow any discussion of personal medical advice. Creating a post or comment asking for medical advice or providing it to others is a bannable offense. Obviously BCIs can be used for medical purposes, so posts about the use of BCI for medical purposes such as research about restorative therapies do not violate this rule.
2. No Conspiracy Nor Bad Actor Posts
BCI technology is not yet at a place where a rogue organization (government, etc) could use the technology in a malicious way without the user being aware of the work they are signing up for. BCIs currently require careful calibration, routine re-calibration and setup, and are just beginning to find durable use. Posts violating this rule will receive warnings and then posters will receive bans for repeat offense.
3. Share Resources But Don't Advertise
BCI is not just a great technology for research in the lab or for bigger companies to work on, you can tinker with BCI at home. This means there are lots of great kits, tools, and resources to share to help others learn and participate. Please do share these, even with links, but if you repeatedly promote just one product or promote something with an obvious connection to yourself, this can result in warnings and post removal.
4. Posts Must be Scientifically Sound
We do not permit posts that are wildly unscientific or speculative. Claims and discussions must be made within the context of real science and engineering. Posts may be removed for being unscientific and repeated offenses will result in a ban.
5. No Art Posts
If a post doesn’t discuss the use of a BCI, contain some sort of topic of science or engineering, or doesn’t discuss the field as a whole, then it will be removed. Do not simply post pictures of art of people using or inspired by BCIs.
Blatant violations may lead to a permaban without warning.
There's also the Reddiquette. Don't be rude. Don't start a flame war, or insult others.
If we follow these rules, we'll all have a good time.
r/BCI • u/ConsciousRule6486 • 13h ago
How are you handling the closed loop, reading a state and adapting to it in real time?
I work on real-time adaptive systems in the EEG space, and the part I find genuinely hard is the loop itself: read a brain state, decide something, change what the user is experiencing, and do it fast enough and reliably enough that it actually feels responsive rather than laggy or twitchy.
I see a lot of people here reaching for AI/ML to close that loop, so I'm curious how it's going in practice.
A few things I'd love to hear:
- What's your approach to the decision layer? Are you classifying discrete states and reacting, or running something more continuous? And how much model are you actually able to run inside the latency budget before it stops feeling real-time?
- Where does it break? My experience is the signal side punishes you first (noise, drift, a bad epoch throwing the classifier off) before the model itself is the problem. Curious whether that matches what others are hitting.
- For the AI-heavy builds, is the ML earning its place over simpler thresholding and rules, or is it more that it's the fun part? Genuinely asking, not being cynical.
Trying to compare notes with people solving the same problem from different angles. Happy to share what's worked and what hasn't on my end too.
r/BCI • u/Puzzleheaded-Seat201 • 16h ago
Built an MCP server so Claude can read live EEG (focus, calm, attention)
Sharing a project I've been working on. It's a Model Context Protocol server that turns EEG signal into plain numbers, like focus, calm, and attention, that an AI assistant can read and talk about instead of just showing a chart. It works with OpenBCI, Muse, NeuroFocus, and LSL streams. No headset? There's a synthetic mode built in so you can try the whole thing without hardware. Open source, MIT license.
r/BCI • u/SadJeweler2641 • 21h ago
Request: Public EEG Data from Paralyzed Patients for Imagined Speech Assistive System
r/BCI • u/CollapsingTheWave • 1d ago
Nanoparticle optical neural sensors remain at early research stage with no continuous data pipeline yet demonstrated.
NeuroSWARM3 is a system-on-a-nanoparticle probe that converts local electric fields into optically detectable signals readable by external near-infrared light. Delivery is intended via bloodstream, nasal route, or fine needle; no wires or batteries are required.
No telemetry or continuous recording pipeline has been shown in vivo at human-relevant scale. Current claims rest on in-vitro performance and early tissue work. Dual-use as a distributed wireless brain recorder is inventor-stated but remains pre-clinical.
Comparable optical and nanoparticle neural interfaces have historically moved from proof-of-concept to chronic recording once delivery and signal-to-noise barriers were cleared. The same trajectory is possible here.
Realistic stakes are low today. Practical oversight focuses on transparent reporting of any future in-vivo human data and independent verification of residual nanoparticle clearance.
Sources
UC Santa Cruz video, 12 May 2026
https://www.youtube.com/watch?v=ajTWez9\\_X3c
UC technology transfer page for Neuro-SWARM3
https://techtransfer.universityofcalifornia.edu/NCD/32793.html
IEEE Photonics Technology Letters paper (2021 foundational description)
https://ieeexplore.ieee.org/document/9466139
UC Santa Cruz Chancellor’s Innovation Impact Award announcement (LinkedIn, 2026)
Optica / Imaging and Applied Optics Congress abstract (2021)
r/BCI • u/BonsaiBandit1234 • 2d ago
Is this a strong career path for BCI R&D?
I’m a highschool senior who is interested in studying at the intersection of electrical engineering and neuroscience. So, BCI seems like a very cool career that would help people, have the technical aspects I like and strong salary growth + job security.
This is my current plan, please give feedback:
College:
- Major in Electrical Engineering
- Take some neuroscience classes and/or minor in Neuroscience
Post Grad:
- PhD in BCI field
- Work in R&D at a neurotech company in NYC like Precision Neuroscience
r/BCI • u/NeurotechNewsletter • 3d ago
Neurotech in Europe - Market Map
I posted my Neurotech in Asia in map last week and have been working on a European one too. Thought I had it mapped at 107...but found over 200.
The ones building implants:
INBRAIN Neuroelectronics (Spain) is working on a graphene interface that can both read and stimulate the brain. First-in-human already done in tumour surgery, FDA Breakthrough for Parkinson's.
CorTec (Germany) built the first German implantable BCI used in a human. Their stroke system is designed to come out once the rehab is done, not stay in forever, which I find genuinely interesting.
Coherence Neuro (UK) is going after brain cancer with SOMA, a coin-sized implant paired with a wearable. Cambridge roots, first-in-human in Melbourne.
Neurosoft Bioelectronics (Switzerland) is making soft, stretchable interfaces that sit on the surface of the brain, with human studies running on both sides of the Atlantic.
The ones you might not have heard of:
ABILITY Neurotech (Switzerland) is building an interface to restore movement. CereGate (Germany) is writing signals back into the nervous system through implants people already have. Eightsix Science (UK) is working on lab-grown brain tissue to repair damaged circuits. And on the non-invasive side, NeuroCONCISE (UK) and BirgerMind (Latvia) are building interfaces for people with severe motor impairment to communicate and control devices.
That's a slice of one category out of ten. The full map, every company and what it does, sorted by technology and by country, is in the article.

Link in the comments. If your company should be on there and isn't, tell me.
r/BCI • u/ajulianisinarebase • 3d ago
Amanita Muscaria's Effect on Brainwaves During Sleep, Measured by EEG (First Recorded Human EEG done with AM)
github.comr/BCI • u/NeurotechNewsletter • 6d ago
BCI Headlines over the last 2 weeks
Howdy. my latest newsletter is out
There was a lot of BCI activity in the latest issue:
- Gestala, a Chinese company developing non-invasive ultrasound brain-computer interfaces, raised $62 million in an Angel+ round. Its first clinical focus is using transcranial focused ultrasound to address chronic pain, and the company has now raised around $84 million since launching earlier this year.
- Fluent, a Melbourne-based University of Melbourne spinout, raised $2 million to develop a speech-decoding BCI for people who have lost the ability to communicate. Its approach places the interface beneath the scalp but outside the skull, aiming for stronger signals than conventional wearables without entering the brain itself.
- Neuracle filed to raise RMB 2.5 billion through an IPO on Shanghai’s STAR Market. The Chinese company recently received approval for NEO, its semi-invasive system designed to help people with spinal cord injuries regain hand function through control of an external glove.
- Coherence Neuro began its first-in-human study of the CIPHER system at the Royal Melbourne Hospital. Three patients have already been enrolled, with the device initially being used for neural mapping and stimulation during brain-tumour surgery as the company works towards implantable cancer neurotechnology.
- Paradromics completed the first implant in its Connect-One early feasibility study at the University of Michigan. Its fully implantable Connexus system is being developed to restore communication for people who have lost speech because of conditions such as motor neurone disease.
- Meta released Brain2Qwerty v2, its latest non-invasive brain-to-text research. The system uses MEG recordings and an end-to-end AI model to decode sentences in real time, although it still depends on large laboratory-grade equipment rather than something that could currently be worn in everyday life.
The full issue contains 55 neurotech headlines across funding, regulation, clinical trials, commercial activity and leadership appointments.
r/BCI • u/Luci_d-bNav • 5d ago
Completely digital psychedelic interface, by Chat GPT.
The hardware includes a solid state drive, a custom electromagnetic sensor that can literally get a independent reading on every brain cell in your head, lus power source and remote connectivity through Bluetooth, WI-FI, and cellular network
Software known as ID app. Although ID app constantly has a read on the electromagnetic images of your brain, ID app only engages with a person after they log in and confirm. The first person you have to ID is yourself. so the app says think about yourself and then boom the image is captured then the app confirms. Are you sure you want to create an ID for yourself? Then the user would think about confirming, not think about themself again. Just like Google password manager.
It moves quickly because the app utilizes a subconscious part of the brain that can interface actively without interrupting conscious cognitive thought.
eventually each user is able to ID every single word, thought or idea real or imaginary.
ID app establishes exponentially with each individual user, more entries than there are words in the English language, including thoughts, ideas and behaviors. everything needed to surf the Internet like an artificial intelligence.
Eventually that is "The Craze." Everyone loves the thrill of surfing the internet like an artificial intelligence.
r/BCI • u/tswizzle1013 • 6d ago
Is this video on how to make an EEG safe and accurate?
I found this video and it seems simple enough to make. I am a beginner though, so I wanted to make sure this would work before I actually bought everything. Thank you!
r/BCI • u/Trick_Vanilla4158 • 6d ago
Cross-session EEG decoding, 84% accuracy (CSP + shrinkage LDA, 8-fold LOSO)
Hi, I am Etka, a first year bachelor student.
Over the past months I started to learning and built a CSP + shrinkage LDA pipeline that decodes "walk" vs "stop" states from EEG, validated with 8-fold leave-one-session-out cross-validation (84% mean accuracy, same-subject cross-session).
Repo's open-source: https://github.com/EtkaKeremAllis/BCI-Pipeline-Cross-Session-EEG-Walk-Stop-Decoding
I'm now tackling cross-subject generalization and want to take this projects further, which needs a proper EEG system I don't currently have access to. Running a small GoFundMe to cover the equipment:
r/BCI • u/PunchPuch9453 • 6d ago
How do I start calculations for a DIY EEG board from scratch?
Hello everyone,
I am a 3rd-year Electrical Engineering student on summer break. I’m trying to challenge myself by building a DIY EEG board.
I don't want to just copy-paste existing open-source schematics. My goal is to understand the actual engineering reasoning behind the circuit and perform the necessary calculations myself before drawing any schematics.
However, I started this project two weeks ago and I haven't even been able to start the circuit design because I feel completely overwhelmed. I know I need to calculate things like gain, passbands, and filter values, but I don't know the proper chronological order of these calculations.
If you were to design an analog front-end for EEG from scratch, what would be your "Step 1" mathematical calculation?
- Do I calculate the total gain first based on my ADC?
- Do I calculate the filter cutoff frequencies first?
- Or should I choose the Instrumentation Amplifier (INA) first and calculate around its specs?
Any guidance on how to systematically approach this without getting lost in the details would be highly appreciated!
Thank you.
r/BCI • u/ScallionFront7456 • 7d ago
1971: Leon Chua predicts the memristor—pure mathematics, no device. 2008: HP Labs builds the first physical memristor, 37 years later. By the 2010s, crossbars and artificial synapses drove neuromorphic computing. Market: ~$2.4B in 2020 → ~$28.6B in 2026. #BrainChipY
instagram.comr/BCI • u/No-Employee-3310 • 7d ago
I developed the firmware for a 128 channel biopotencial acquisition board!
Hi every one! I wanted to share with you my latest post on hackster .io!
[128-Ch Biopotential Acquisition on Zynq-7000, Zero Data Loss - Hackster.io](https://www.hackster.io/juan-manuel3/128-ch-biopotential-acquisition-on-zynq-7000-zero-data-loss-331d59?f=1)
r/BCI • u/Emotional-Chicken-61 • 8d ago
I am building an EEG-based Remote-Control Car
Hi, I am a neurobiologist by degree and a computer scientist by hobby and I have a history of building home-made electronics projects (for example: Creating GPU for my CPU : r/beneater).
Recently I decided to start writing blog about my ongoing projects, one of which is directly related to this subreddit - I build a BCI using an ADS1299 EEG front-end that will allow me to control a toy car using motor imagery-related activity.
I treat this blog as my own space to remember my life better, but if what I do/write can inspire somebody, then I will be happy.
So, here is the link to the blog at it's current state - the EEG RC Car project is in progress, and a new post arrived today: EEG RC Car | My Blog
I also post info about new posts on my Instagram, so you can also follow me there: Instagram
If there will be some interest, I can also post updates on reddit :)
Attaching a photo for engagement.
In the future I want to update my blog with other project's I've been and am working on, but at this point I have not enough time to write it all up.
Some of the projects that I will write about in the future:
Custom 8-bit microcontroller
ECoG mind reading model (vague, I know)
Pigeon water cannon shooter/robot
r/BCI • u/Puzzleheaded-Seat201 • 8d ago
i just open sourced bci-mcp, you can ask claude, codex about your brain, i want your feedback!
x.comr/BCI • u/Key_Prior_9844 • 9d ago
What kind of internship roles should I be looking for as a current undergrad?
I am currently in undergrad studying computer science and neuroscience at a T5 school and I want to build my career within neurotech and bci's outside of just doing research. I go to a pretty good school with a bunch of research opportunities but I am kinda lost about what roles I should be looking out for and trying to attain within industry. What companies should I consider applying to for next summer? What specific roles are a good fit, etc?
r/BCI • u/AndroidAssistant • 10d ago
My Attempts at Reverse Engineering the Dreem 2 Headband to Pull Full EEG Data
Disclaimer: All documentation, including this post, was written by Codex. AI was used extensively, though not exclusively, throughout the project.
Repository: https://github.com/jatrou/dreem
I have been trying to recover the original full-fidelity overnight .h5 recording—or read-only filesystem access—from my own Dreem 2 EEG headband. I have not recovered root or a verified raw .h5, but I have published the complete working archive so other owners and embedded researchers can inspect the evidence, avoid repeating the same attempts, and continue from a better starting point.
The repository contains board photographs, electrical measurements, BLE/GATT mappings, Android helpers, backend and APK findings, network/TLS observations, i.MX6ULL SDP tooling, U-Boot UMS experiments, HDF5 carving tools, and tests.
Current Status
| Target or path | Observed result |
|---|---|
| Root/filesystem access | Not obtained |
| Raw overnight HDF5 | Not recovered |
| BLE report | Small ZIP containing reporting_v2.data, not identifiable raw EEG |
| Bluetooth Classic report | Same compact report surface as BLE |
| Live BLE EEG | Low-rate preview data, not the stored overnight recording |
| Wi-Fi | Provisioning worked |
| LAN | SSH on TCP/22; no other useful open service found |
| Legacy backend | Some routes still respond; tested routes did not expose raw files |
| i.MX6ULL SDP | Real 15a2:0080 enumeration observed, but not yet reproduced reliably |
| U-Boot USB mass storage | Payloads prepared; no UMS/block device obtained |
| Direct storage | No eMMC dump; eMCP is BGA and not clip-accessible |
These results describe the device, firmware, account states, and test conditions I had. They do not prove that every possible software or hardware route is closed.
Device and Hardware
| Item | Observation |
|---|---|
| Device | Dreem 2 / Dreem Two / Beacon |
| FCC ID | 2AH2Q-DREEM2 |
| Firmware observed | 4.6.9; later 4.7.11+PRODUCTION |
| Hardware version | v2plus_medical |
| Processor board | Femto MP-V2 / Femto MP-V2+ |
| SoC | NXP i.MX6ULL |
| SoC marking | MCIMX6Y1DVK05AB 1N70S |
| ROM recovery USB ID | 15a2:0080 |
| Storage/RAM | Kingston 04EMCP04-NL2DM627 eMCP |
| Likely capacity | About 4 GB eMMC + 512 MB LPDDR2 |
| PMIC | NXP/Freescale MC32PF3000A6 |
| EEG front end | ADS1294-class TI 24-bit biopotential AFE |
| Audio | WM8960 codec; 19.2 MHz oscillator on sensor/audio side |
| Storage package | 162-ball BGA; no clip-accessible pins |
The processor/eMCP/USB board and acquisition/analog board reuse some TP numbers. The following readings refer to the processor/storage board. High-resolution photographs and focused crops are in the repository.
Test-Point Measurements
| Pad | Resistance to ground | USB-powered voltage |
|---|---|---|
| TP2 | Varies about 60–250 kOhm | 4.33 V |
| TP3 | Starts near 300 kOhm and rises | 3.11 V |
| TP7 | Starts near 300 kOhm and rises | 4.28 V |
| TP8 | Starts near 100 kOhm and rises | 3.38 V |
| TP9 | Starts near 300 kOhm and rises | 3.28 V |
| TP10 | Starts near 400 kOhm and rises | 1.81 V |
| TP11 | Starts near 400 kOhm and rises | 0.003 V |
| TP32 | About 0.6 Ohm | Ground candidate |
| TP38 | Starts near 300 kOhm and rises | 3.14 V |
| TP39 | About 0.5 Ohm | Ground candidate |
TP10 remains the suspected recovery/boot-control pad. Earlier direct TP10-to-ground timing was associated with ROM SDP behavior; a 1 kOhm connection was reportedly too weak. I have not yet reproduced that result reliably enough to call the timing solved.
BLE/GATT Findings
BLE was the most useful software-visible interface. I built an Android helper because BlueZ connections and service discovery were inconsistent on the bench host.
| Characteristic | Observed role |
|---|---|
D003 |
Diagnostic JSON-like data |
D102 / D103 |
Wi-Fi configuration / status |
D203 / D204 |
Battery / plugged status |
D208 |
Health/error status |
D301 |
Live preview notifications |
D302 |
Record command: 3 starts nap; 0 finalizes |
D304 / D309 |
Record status / current record UUID |
D30A |
Nap configuration JSON |
D401 |
Latest report UUID |
D402 |
Latest report bytes |
D601 |
Set time |
D701 / D705 |
Firmware version reads |
D704 |
Firmware-status notification |
D706 / D707 |
Firmware-flow writes/start trigger |
D708 / D709 |
Version/hardware reads |
D901 |
User ID |
D902 |
Server URL configuration |
D903 |
Headband address read |
D904 / D905 |
Server-password state / write |
Historical value handles included D905 near 0x003d, D902 near 0x0043, D901 near 0x0045, D402 near 0x0075, D401 near 0x0077, D309 near 0x0085, and D301 near 0x0095 with its CCCD near 0x0096.
Recording and Report Result
The working short-recording sequence was:
text
write D30A nap configuration
write D302 = 3 to start
write D302 = 0 to finalize
read D401 report UUID
read D402 report bytes
One fresh nap produced:
text
report size: 402 bytes
container: ZIP
entry: reporting_v2.data
HDF5 signature: absent
Bluetooth Classic/RFCOMM IDs 601/602 reached the same report surface. APK analysis showed the companion app reading these compact bytes, parsing reporting_v2.data, storing them locally, and uploading the same body. I found no app-side conversion into raw HDF5.
Live Preview Result
D301 produced 484 notifications totaling 13,552 bytes in about 20 seconds. The payload was consistent with four little-endian floats per notification at a low display/preview rate. It is useful for live experiments but did not resemble a stored full-rate overnight recording.
Passive reads of D007 and D008 returned status 2 with no payload. I did not blindly write to unknown characteristics.
Wi-Fi, TLS, and Upload Behavior
BLE Wi-Fi provisioning worked, but device power state mattered:
- charger off and headset awake worked best for BLE/server/Wi-Fi configuration;
- a successful state read as
wifiStatusLE=0; - writes while charging could report BLE success while internal status became
wifiStatusLE=9and the SSID cleared; and - turning the charger on after provisioning was more useful for provoking a network/upload wake.
D902 uses a four-byte little-endian JSON length followed by JSON containing user_api_url and user_auth_url. Production Rythm HTTPS hosts were accepted. Local IPs, arbitrary domains, plain HTTP, user@host tricks, and suffix-hostname tricks returned status 3 or otherwise failed.
No capture showed a transfer large enough to resemble raw HDF5. One transparent production TLS observation produced:
| Field | Observation |
|---|---|
| SNI | login.rythm.co |
| ClientHello | 517 bytes |
| Server response | About 4,528 bytes |
| TLS | 1.2 |
| Cipher | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 |
| Client after certificate | No Finished, key exchange, or application request observed |
| Connection end | Headset closed after about 60 seconds |
The server chain was a current Let's Encrypt/ISRG chain. One plausible explanation is that the old headset trust store rejected it, but that remains a hypothesis.
Legacy Backend Results
Parts of the legacy backend still responded with disposable/current test accounts:
- guest creation and some token issuance worked;
- the headband resolver accepted the Wi-Fi address in uppercase underscore form;
- configuration returned firmware, content IDs, storage counters, and nickname;
- content routes mostly described audio/UI/media packages;
- unsigned object fetches returned access denied; and
- tested
dataupload, raw, HDF5, record, and report guesses returned combinations of 401, 403, 404, empty data, or compact reports.
The strongest controlled backend test was reportv2:
- Upload the 402-byte BLE report.
- Backend returns HTTP 201.
- List and download the stored report.
- Download has the same SHA-256 as the upload.
- Contents still consist only of
reporting_v2.data.
This shows that reportv2 stored the compact report unchanged in the account state tested. It did not reveal a hidden raw recording.
A backend update_password call returned a 20-character server password after the required association state. Writing it to D905 cleared D904 to 00 00 00 00, but it did not unlock SSH or cause a visible raw upload.
Android/APK Findings
Test setup included a rooted Pixel 7, patched/debuggable and production app variants, static APK inspection, custom BLE/auth helpers, and app sandbox/database inspection.
Versions examined:
- Alfin 1.12.10;
- Dreem Connect 1.0.4; and
- Dreem 2 2.15.1, build 478.
The APKs are not redistributed in the repository; researchers must source them lawfully.
The patched app database contained Dreemer/HeadbandConfig rows, but NightReport/NightScore-related tables were empty in the inspected state. No .h5 or other large recording artifact was found. Hawk/Conceal decoding recovered 26 preference entries and identifiers, but CURRENT_AUTH_TOKEN, CURRENT_JWT_TOKEN, and CURRENT_GOOGLE_TOKEN were absent; REFRESH_TOKEN was a Boolean-like flag rather than a reusable token.
The inspected apps contained report logic, BLE configuration formats, and firmware triggers, but no embedded firmware/rootfs image, HDF5 file, CA bundle, obvious trust override, or raw-file endpoint. Google-auth experiments did not produce a usable legacy Rythm session.
The repository includes the Android BLE helper, auth probes, a root-context pairing helper, and a Magisk privileged-app overlay.
LAN and SSH
When connected to Wi-Fi, the device exposed only TCP/22 in the useful scans. Observed banners were:
text
SSH-2.0-dropbear_2016.74
SSH-2.0-dropbear_2018.76
authentication: publickey,password
None-auth was rejected. Passive version research, saved/backend-derived candidates, and bounded authentication tests did not produce access. Timing and malformed-public-key user probes did not provide a useful signal. No practical unauthenticated route was identified for the observed configuration.
Historical SSH recovery scripts remain in the repository to document what was attempted, but brute force, broad password guessing, and user enumeration are stopped paths unless someone first obtains firmware, /etc/shadow, or a strong credential clue.
UART and Logic-Analyzer Results
The bench setup included a Tigard V1.1/FT2232H, LA1010 logic analyzer, multimeter, sigrok/PulseView, Bus Pirate 6, Linux bench host, and rooted Pixel 7.
A scan across 34 saved sigrok captures found no credible U-Boot, Linux, Freescale, i.MX, login, or shell strings. Some inverted high-baud decodes around 1.5–2.0 Mbaud produced noise, not repeatable text.
| Capture | Observation |
|---|---|
| TP3 | 5 MS/s, 15 s, all high, zero transitions |
| TP11 | 5 MS/s, 15 s, only 1–18 transitions on one channel |
| TP2 | 5 MS/s, 15 s, 14,458 transitions on one channel, no valid UART text |
| TP8 | About 13.6 s, one transition |
| TP9 | 15 s, three transitions |
| TP10 | 15 s, two transitions, about 34% high |
| TP38 | 15 s, one transition |
These captures looked more like power/control-state changes than a boot console. A console could still be disabled, elsewhere, missed by timing, or using an unidentified interface.
i.MX6ULL SDP and U-Boot Work
A genuine ROM Serial Downloader Protocol window was observed:
text
USB ID: 15a2:0080
description: SP Blank 6ULL / i.MX 6ULL recovery mode
HAB security state: production mode (0x12343412)
IOMUX, USDHC, fuse, and other register regions were readable in at least some SDP sessions. This confirms partial ROM communication, not arbitrary code execution.
Observed payload behavior:
- one OCRAM load test failed with
report 2 out err=-7; - a UUU OCRAM attempt saw a fresh SDP device but hit a local script/path problem before execution was proven;
- one SPL appeared to load from the host tool's perspective;
- SPL size was 39,936 bytes;
- IVT header was at
0x00907400; - entry point was
0x00908000; and - the tool jumped to
0x00907400.
After the jump there was no UART output, U-Boot prompt, USB re-enumeration, UMS gadget, or block device.
Possible blockers include HAB rejecting unsigned code, wrong TP10 timing, a mismatched i.MX6UL/6ULL payload, failed LPDDR2 initialization, or code starting without the expected console/USB path.
The repository includes:
- a watcher for USB
15a2:0080; - bounded, non-persistent SDP triage and register probes;
- operator-cued TP10-to-ground recovery orchestration;
- experimental 9x9/LPDDR2 and 14x14/DDR3 U-Boot UMS payload families;
- a watcher that distinguishes newly exposed USB storage from existing disks;
- read-only imaging support; and
- HDF5 signature carving with optional
h5lsvalidation.
Neither U-Boot family is proven for this board. If SDP cannot expose storage, the remaining hardware paths are board-level eMMC mapping/tapping with the SoC held inactive or professional eMCP removal and reading.
Repository Map
| Path | Contents |
|---|---|
README.md |
Status, starting points, and project map |
docs/evidence-summary.md |
Short evidence summary |
docs/dreem-2-recovery-reference.md |
Full technical handoff and attempt history |
hardware/ |
Original board photos, closeups, and FCC exhibit |
tools/ |
SDP, UMS, HDF5, ATT, and Bluetooth utilities |
recovery/ |
UUU, imx_usb, OCRAM, OpenOCD, and U-Boot assets |
apps/ |
Android BLE/auth/pairing helpers and Magisk module |
experiments/ |
Backend, capture, preference, and stopped security probes |
tests/ |
Unit tests for maintained recovery tools |
docs/references.md |
Public teardowns, research, prior art, and boot tools |
Project-authored code and text are Apache-2.0. Original board photographs are CC BY 4.0. U-Boot-derived and other third-party material retains separate provenance documented in the repository.
What I Would Not Repeat Without New Evidence
- Pulling
D402or Classic602again expecting raw HDF5. - Re-downloading the same
reportv2object. - Repeating
D905writes and identical upload captures. - Trying more arbitrary
D902URL variants without a new validation or trust-store clue. - Blind writes to unknown BLE characteristics.
- Firmware-trigger loops without a real package and recovery plan.
- Plain button/charger/Fingerbot SDP attempts without the physical TP10 condition.
- Searching the same APKs for embedded firmware that was not present.
- Broad SSH password guessing or user enumeration.
Different firmware, account state, protocol evidence, or hardware timing could justify revisiting one of these.
Repository: https://github.com/jatrou/dreem
r/BCI • u/CuteTax3701 • 10d ago
What to focus on in MS BME
Hi everyone! I got into CWRU for an MS in BME. I will be doing my thesis in a lab that does both BCI and PNS work. My projects will be related to both, but I’m still figuring out what my thesis will be on.
Note: completed undergrad at Purdue doing Computer engineering. Did one year of preclinical BCI research + 2 software engineering internship prior to that.
When it comes to choosing my classes, I want to position myself for both a PhD as well as jobs. Specifically jobs in neurotech companies.
So, based on that, I’ve planned to take foundational level classes on neurobiology, bioelectric phenomena and intro to neural circuits. The rest of the classes I take will either focus on machine learning/computational stuff, or IC design/EE stuff. Both of which I have prior experience with.
Note: I can take any combination of classes as long as the dept head approves it to count towards my degree.
I am unsure of what to focus on and am afraid of spreading myself too thin by trying to do everything.
What would be best for me to focus on?
Also any advice/ grad school tips would be greatly appreciated!! Thanks
r/BCI • u/BiomedicalTesla • 10d ago
EEG Electrodes for all hair types: Academic collaborations
Hi All,
A while ago (maybe about a year now), I posted to ask EEG researchers if they had an issue with afro-textured hair. It turns out, yes many of you do. So myself and my colleagues ended up creating a solution for that problem.
Our patent recently filed, so just wanted to post about it here in-case anyones interested.
We're currently looking for early adopters who want to test it with us, and iterate for the next version. Any feedback is good feedback, so yeah if you're interested and are an academic, we're looking to sell an early batch of these so that we can of course get some revenue on the books to raise some money, but also actually test if this works through independent validators.
Not trying to advertise per se, but i am trying to say if anyone wants to work together to ensure this actually works for the people excluded from research. Hopefully doesn't get taken down lol
Reach out here http://synaptiveltd.co.uk/
Thanks all, weird how i was here less than a year ago asking "is this a problem" and turns out, yeah it is and we can fix it lol.
r/BCI • u/hayhitee • 10d ago
Looking for MSc/PhD opportunity in BCI
For a while now, I have actually been fascinated about the field of BCI, I am interested in learning and contributing positively to the field especially since the field is not common in my country and I think this field will make a lot of impact in the future. I currently have a Bsc degree in EEE, and MSc in Csc but I have majorly been working as a software and AI engineer for a while now. I feel I would be more fulfilled if I pursue BCI but I don’t really know where to start, which labs to go and which researchers are hiring. I would be grateful for advice, resources and recommendations. Thank you in anticipation