I'm attempting to control a toy RC car with my own custom input device over BLE. The RC car is typically controlled by an app, and I've logged decrypted BLE packets from a session between the app and the car. Each command packet from the app has an incrementing counter followed by a length byte that indicates how many remaining bytes are in the packet (plus one).
[2 bytes: counter] [1 byte: remaining packet length "n"] ["n+1" bytes: message]
I've generated a number of packets that tell the car to "turn right". Each of these packets contains a 6 byte message; however, the 6 bytes are different every time, indicating some sort of custom encryption scheme from the RC vendor driven by the counter.
Given that I have many repeated samples of the same message, what tools are at my disposal to identify the encryption scheme and decrypt the protocol?