Clapier
A Nabaztag:tag revival: an HTTP burrow in Rust, the Garenne bytecode, low-level WPA2/3 fixes deep in the nabgcc firmware, and EDF Tempo prices announced by a rabbit.
- Role
- Reverse engineering, firmware, server, web app.
- Period
- 2026
- Stack
- Metal bytecode, C (nabgcc firmware), Rust (axum), Svelte 5, Kyutai Pocket TTS
The brief
Violet’s Nabaztag:tag is a Wi-Fi rabbit with motorized ears. At every boot, it downloads its application from Violet’s servers, shut down long ago. Violet published the sources, and RedoXyde derived nabgcc from them, a port of the firmware to GCC.
My rabbit accepted a phone’s hotspot and refused the home router. Once connected, it stopped receiving traffic after 25 to 60 minutes. I launched Clapier at the end of July 2026 to fix these two problems: a fixed firmware, and an application and a server written for this model.
In use
Installation takes three steps: flash the wpa23-gtk firmware once, run clapier, then give the rabbit the Wi-Fi key and the server address. At first boot, Clapier registers the rabbit and serves it Garenne, my application.
The web interface shows each rabbit in a tile, with an avatar whose ears follow their real position. Buttons make the rabbit salute, silence it, reboot it, start a choreography, change its color, move its ears or have it read a text.
Maison, my home dashboard, uses it for the electricity rate. Every fifteen minutes, the rabbit’s belly takes on the color of the EDF Tempo day. The ears announce the next day: both when RTE has published the color, the left one alone when the forecast reaches 80%.
Architecture
The firmware stays in C and embeds the Metal virtual machine, which runs Garenne. The Wi-Fi driver passes on raw frames, and Garenne implements its own network stack, from ARP to TCP.
On the server side, Clapier is a Rust binary that implements the 2006 HTTP the rabbit expects. At boot, the rabbit sends its MAC address; Clapier looks for each file in that rabbit’s folder, then in the shared folder. Testing a version on a single rabbit comes down to dropping in a file.
The WPA2 fixes
The nabgcc Wi-Fi code contained four bugs. The association frame advertised a cipher suite (00-0F-AC-00) that routers in WPA2/WPA3 transition mode refuse; it now reuses the ciphers recorded during the scan. strcpy truncated the PMK, the key derived from the Wi-Fi password, at the first zero byte. The linker script omitted 56 .bss.* sections, so the EAPOL state started with the contents of RAM at power-on.
The fourth bug explained the loss of reception: aes128.c contained three empty functions. The rabbit had only its pairwise key, and broadcast packets, encrypted with the group key, stayed unreadable to it. I wrote AES-128 decryption (about 2 KB), RFC 3394 unwrapping and group key parsing; a broadcast ping then received its reply.
Decisions
The server prepares, the rabbit reads. Garenne reads only fixed formats, binary or line by line. Clapier prepares the rest, from choreographies to MP3 files encoded like Violet’s.
New code. The Violet sources and the ServerlessNabaztag project served as my reference; the Garenne code is entirely new.
A short test loop. Before TCP, I set up a light fade, a logging channel and a remote reboot. A new version reaches the rabbit in about thirty seconds, and a faulty version is fixed by unplugging it.
Diagnosis by radio. During the loss of reception, the rabbit could still transmit: I had it broadcast its Wi-Fi counters every two seconds. The cryptography was validated on a Mac with the FIPS-197 and RFC 3394 test vectors.
Today
Clapier runs on a Raspberry Pi 1, next to Maison, and manages Garen, my rabbit. On 28 August 2026, RedoXyde merged my fixes into the nabgcc wpa2 branch. Both repositories are public, under the MIT license.