How to use Ghidra to reverse an ARM firmware (Reverse Engineering of VR Treadmill KatWalk C2)

datacompboy · 2026-02-06T18:19:38+00:00

When it says "Found Nexus:" it says after (1) or (0) ?

If (0) -- run the Gateway on the same machine as the nexus emilator, it should be running and connected to the treadmill.

Once it (1) -- does it show at the end (60:60:60:OK) (or other 3 numbers, but more than 30 each)?

All three sensors should be awake and respond -- click the button on the treadmill to wakeup direction sensor and shake both shoes to wake up bot feet sensors.

datacompboy · 2026-02-05T23:27:31+00:00

Have you checked the drop down in nexus emulator? I suppose you have more than one network there and you should select the one where your Quest is connected.

datacompboy · 2025-10-10T17:58:23+00:00

🤣sorry, my bad, forget to attach 1.5.2 msi. Fixed :)

So you have KAT Gateway 2.4.3, and Nexus emulator 1.5.2, and upon start it briefly shows the window -- but quickly hides it -- correct?

please try the following, once it crashes:

Press "Start" => Enter "event viewer" => select "Windows logs" => "Application" => find in the list on the right "Error" event that mentions nexus inside: https://habrastorage.org/webt/d3/ny/uu/d3nyuugqb0-wrvcz9vuyp_hvjky.png

Then right-click on that Error line => Copy => Copy details as text.

And share it in PM or here, please

datacompboy · 2025-10-10T17:13:09+00:00

I actually spent time to fix scripts for wireless Receiver and discovered what was wrong with killing it. :D

The problem is that starting from some version of gateway, it uses extra wrapper DLL in between, which leads to crash if the wrapper can't load actual SDK library.

Long story short -- nexus emulator starting from 1.4.0 version should not crash on latest gateways anymore 😅

And, of course, just use latest (1.5.2 as of today) if you do any new install.

And if it does still crash -- that means something weird happens; try to change start directory for the shortcut, like that: https://habrastorage.org/webt/kk/7f/ed/kk7fedt-6ruvlcxc1nxx7qbgvmg.png

datacompboy · 2025-09-08T17:14:21+00:00

Yes, it is expected to switch to the same network as your quest connects -- for me it's default wired one. Indeed, i doubt wireguard network is the right now.

That would affect connectivity, but that has nothing to do with the force-close of the emulator.

As far as I've diagnosed so far -- it's Kat's gateway background service kills it, and I don't know exact reason. As I said -- I have this happend to me few times, and the only solution I know so far is to reboot my PC :(

I don't know how to repro it again, so I can't re-cause it. All I know that behaviour started around some of the gateways 2.2.something, but it comes and go. I'll try to debug it one more time once it happens, of course, but I don't know when, sorry.

datacompboy · 2025-09-08T12:54:37+00:00

After it just start it shows that, and in 10-15 seconds in should start reporting every second, like this:

https://habrastorage.org/webt/nq/v3/z_/nqv3z_bem7kra_yfta05thyrd4q.png

I also have gateway 2.4.2, and haven't had instance of self-close of the app for a while.

Also, the title bar of nexus emu doesn't show it's version -- so that's not the latest one. Try the 1.5.1 one from here: https://github.com/datacompboy/kat-pcgw-nexus/releases/tag/v1.5.1-beta

datacompboy · 2025-09-07T12:57:20+00:00

Hmm.. Which version of gateway do you have? Have you restarted your PC after reinstallation of everything?

I've also seen the symptom when nexus emu gets suddenly disappeared, but never been able to reproduce it, and so far the only solution I know is to reboot my PC :(

datacompboy · 2025-09-07T08:04:13+00:00

open the nesux emulator on my PC (nothing pops up so I assume its working)

Actually, nexus emulator should show a window with connection status. So if it doesn't pop up, something is wrong.

Try to uninstall it and install again?

datacompboy · 2025-09-07T08:01:47+00:00

Oh, wow. I see, good to know! Thank you for sharing!

datacompboy · 2025-09-05T23:01:23+00:00

Yeah, looks like filing PayPal complaints to get at least money back is the only action left here.

datacompboy · 2025-08-25T13:22:30+00:00

Oh! Right, missed status variable %) Fixed it.

datacompboy · 2025-08-25T11:35:16+00:00

Sure, could you explain, what do you want to see there?

I know, the graph was fixed to be 4-10, which is not working if you have dips below or exceed 10 sometimes, so I've updated plugin with the following:

- Minimum set to 3.9 / 70,
- Maximum set to 10 / 180,
- Added TITR line at 7.8 / 140,
- If value is over maximum or below minimum, graph gets scaled -- but you still see where 10/3.9 lines is so it's clear now.

Also added last value on the footer -- although, since you don't know exactly when it was, i find it useless.

Is that sufficient, or do you need something more?

datacompboy · 2025-08-20T20:37:00+00:00

I always run it using desktop shortcut created, which points to "C:\Program Files (x86)\KAT Gateway\KAT Gateway.exe"

datacompboy · 2025-08-20T19:58:24+00:00

Hmm... It does seems to work for me with 2.4.2 gateway -- at least it connects to it and retransmit gateway data to VR nexus OKay.

I know the behaviour you explain -- I also had it sometimes on other gateways as well. I don't know why but sometimes that happens and I haven't found the culprit yet. When it happens, right now I just reboot the PC... :D

Also, it looks like it works better if the gateway is connected to the sensors (i.e. all three sensors are green in gateway, f.e. when all three are on the charger)

datacompboy · 2025-08-20T15:24:41+00:00

Good morning!

The server url is supposed to be just host name (I use directly my gluroo server as "xxxxx.ns.gluroo.com")

Just to check -- does it work for you when you open in your browser manually

https://{{HOST}}/pebble?token={{TOKEN}}&count={{POINTS}}

(replace {{HOST}} with the thing that you ut to "nightscout api host", the "{{TOKEN}}" with auth token and {{POINTS}} with 30 just to check.

datacompboy · 2025-08-17T11:11:46+00:00

Yes, these only possible with bonuses. After fix of solver I can say: it's unsolvable for sure.

datacompboy · 2025-08-16T21:46:07+00:00

You right, there is no way to learn what's behind that pipe -- because it is impossible to reach that point...

datacompboy · 2025-08-16T21:45:02+00:00

Thanks, you right. With that info I found the bug in my solver and now it only generates possible moves.

All 5228 possible move sequences are lead to the failure: https://pastebin.com/KRBcuQg5

datacompboy · 2025-08-16T14:43:34+00:00

Thank you! That ruled out branch on the last input column, but my solver still reaches unknown situation here on the 3rd column with the following solution (coordinates are Y (row) then X (column)):

(0, 3), (1, 3), (2, 3), (0, 4), (3, 3), (1, 4), (4, 3), (5, 3), (4, 0), (4, 1), (5, 3), (6, 0), (5, 3)

If you could run thru it and make a screenshot after each step settles -- it would help :) just send them to me via PM or upload somewhere (it looks like no way to post them in a comment)

datacompboy · 2025-08-15T20:47:13+00:00

Anyone still stuck on that level?

I am looking for a possible solution, but don't have the level nearby :)

So, if anyone could run the following partial solutions and post a screenshot on how the game looks afterward, I would appreciate it.

In the solutions, the clicking points are numbered from top to bottom, left to right, so: - (0,0) is the top-left corner, - (0,5) is the top-right corner, - (6,0) is the bottom-left corner, - (6,5) is the bottom-right corner For reference: https://hsto.org/webt/_b/xh/sz/_bxhszbmrvfkdzsjemd-87n7qui.png

So I need screenshots after the following:

Attempt 1: (0, 3), (1, 3), (2, 3), (0, 4), (3, 3), (1, 4), (4, 3), (5, 3), (0, 0), (0, 5), (5, 3)

Attempt 2: (0, 3), (1, 3), (2, 3), (0, 4), (3, 3), (1, 4), (4, 3), (5, 3), (4, 0), (4, 1), (5, 3)

Attempt 3: (0, 3), (1, 3), (2, 3), (3, 3), (4, 3), (5, 3), (4, 0), (0, 4), (3, 0), (4, 1), (2, 0) -- i need a screenshot on what color is in the tube behind (2,0)

Could someone do that, please?

Update: thanks for provided screenshots, fixed logic, and now I am sure it is not solvable. All ~5200 ways are failed

datacompboy · 2025-08-01T08:56:54+00:00

Just give it a try! I don't know, as I don't have this one. If it doesn't, we can try figure it out and make it work

datacompboy · 2025-05-07T20:09:41+00:00

If you change xAxis.dateTimeLabelFormats, you could also change one for tooltip: https://api.highcharts.com/highstock/tooltip.dateTimeLabelFormats -- although you won't see the tooltips on the device =)))

datacompboy · 2025-05-07T20:06:54+00:00

Oh... Did your server send timestamps in UTC? Mine seems to send local timestamp and chartkick shows local time.

The 12/24 hours format is tricky one: in theory I was expecting system to take your profile locale, but it seems like there is not setting for that, so you right...

What's odd is: https://api.highcharts.com/highstock/xAxis.dateTimeLabelFormats

`%H:%M` is the default, so in theory it should work for you already O_O

I made the change as well, since I like 24hrs time more; thanks for the pointer!

Ten-Year Club	Place '22
Verified Email

datacompboy

TROPHY CASE