Image: Jabez Winston / jabezwinston.github.io · The released InvenSense DMP programmer manual showing the MPU6050 opcode map
An InvenSense motion processor’s undocumented ISA decoded
Jabez Winston used Claude-assisted analysis and hardware probes to reverse engineer the InvenSense DMP instruction set and publish a manual and Python-based compiler.
Credits
- Build author Jabez Winston Source ↗
- Reddit poster jabezwinston Source ↗
Earliest dated source: Details reviewed:
The full story
Jabez Winston investigated the undocumented Digital Motion Processor inside InvenSense motion sensors. Claude-assisted statistical analysis, heuristics and hardware experiments were used to decode instruction behaviour rather than assuming a familiar ARM or x86 instruction set.
An ESP32 acts as a UART-to-I²C bridge to an MPU6050, allowing Python probe scripts to load programs, step execution and read results. A simulator and disassembler capture the discovered behaviour in code, and a Python-based compiler helps test whether that understanding holds when solving larger problems.
The published result includes an instruction-set manual, probe scripts and the compiler. The described physical harness uses an MPU6050; the manual also covers the related DMP3 in the ICM-20948. The maker’s process depends on readable, replaceable firmware and real hardware feedback.
Before and after
- Starting problem
- The sensors’ internal DMP instruction set was undocumented publicly.
- Reported result
- Published ISA documentation, probe scripts and a Python-based compiler.
Device and compatibility
- InvenSense MPU6050 hardware harness with ESP32; DMP3/ICM-20948 documentedSource ↗
What you need
Can it be undone?
Volatile test programs: The maker reports that the test harness loads DMP memory in RAM and a power cycle restores the device. This describes their harness, not every firmware modification. Source ↗
What Claude did
- Instruction-set analysis, statistical probes, emulator/disassembler and compiler developmentClaude Source ↗
How it was done
Tools
Themes
Loading themes…
Sources
From a short post by the maker, so the details are as they tell them.
- Reddit: Reverse engineering the instruction set of the Processor found in MPU6050, ICM20949 accelerometer/gyro combo chips
The maker's post describing the project, reported hardware tests and current limitations.
- Invensense DMP: Reverse engineering the undocumented Instruction setArticle author: Jabez WinstonPublished Source checked
- The DMP Programmer’s ManualSource checked