Questions tagged [bluetooth]
The bluetooth tag has no usage guidance.
23 questions
0
votes
0
answers
68
views
Reverse engineering a Bluetooth smart lock (Aqara N200)
I have been working reverse engineering a Aqara N200 as I'd like to now control it in Home Assistant rather than just near the lock with the Mi Home app, my plan is to use a ESP32 running ESPHome to ...
- 1
1
vote
1
answer
93
views
Sniff Bluetooth traffic using Fitness Tracker
I am attempting to sniff the Bluetooth between the fitness tracker(GOJI ACTIVE GFITBK20 Activity Tracker) and the application(Goji Active) installed on the phone but I am unable to see any health ...
- 11
0
votes
0
answers
46
views
What Kind of BLE Handshake is This?
I have a peripheral to which I am trying to connect over BLE. I do not have access to the internals of the peripheral, though I do know it is using a TI CC2540 chip for its BLE implementation (not ...
- 101
0
votes
1
answer
111
views
Filter BLE UART communications from Android HCI BT Snoop log in Wireshark
I managed to log BLE communications with a Nordic chip based device I am interested in on my Android phone and loaded the log in Wireshark, applying btatt as filter.
It uses some default BLE "...
- 111
0
votes
1
answer
143
views
Bluetooth speaker firmware modification
I don't know if this is the right community to ask this to but I have this speaker and I want to change the startup, shutdown sound effect of it. It is not a chinese BT speaker but a Hama soundbarrel. ...
- 1
2
votes
1
answer
227
views
How to send HID commands over USB? Laird BT820 in HID-Proxy mode
I'm trying to get Bluetooth devices to work in HID-Proxy mode with a Laird BT820 dongle. According to their docs at http://cdn.lairdtech.com/home/brandworld/files/Application%20Note%20-%20BT800%...
- 31
4
votes
0
answers
100
views
Why would a packet-based protocol occasionally XOR it's payload?
I'm REing the Bluetooth protocol for the Ecoflow Delta 2 power station, and so far I've had some success. But there's a strange behaviour that, while not hampering my efforts, has me puzzled.
The ...
- 161
3
votes
0
answers
148
views
Inverter BLE communication module receives commands in HCI_ACL but apk shows ATT
I have a solar inverter which can be queried through mobile apps, eSolar O&M or eSolar SET. My goal is to read values from the inverter (solar power, grid consumption...) by querying the device ...
- 141
3
votes
0
answers
65
views
How to decode a bluetooth package from PH bluetooth meter
I'm trying to perform some Bluetooth reverse engineering with a PH/ORP/TEMP probe.
I know where the data comes, but I don't know how to translate it.
The probe shows these values in its Android app:
...
- 31
1
vote
1
answer
82
views
Has anyone reverse engineered the bluetooth protocol of a Mackie Thump GO loudspeaker?
I want to remote-control my Mackie Thump GO loudspeaker without using the official app, so that I can build an app that can control music and the speaker at the same time (and maybe even do some ...
- 121
2
votes
0
answers
74
views
Reverse Engineering Bluetooth led strips unsuccessful
duplicate of this, and a few other kinda but nothing in any have solved my issue
I've got some phopollo bluetooth led strips that I was trying reverse engineer the bluetooth protocol for so I could ...
- 21
1
vote
0
answers
502
views
Reversing Daly BMS BLE protocol by mocking the peripheral
I am working on an app that helps users to monitor their batteries. The app must support Daly BMS and I am reversing the protocol over BLE.
So far, I have the services/characteristics UUID. Some of ...
- 111
2
votes
0
answers
133
views
How can I determine the bluetooth commands needed to communicate with my smart scale via bluetooth using my computer?
I have a Tanita-BC401 smart scale. This scale pairs with the "My Tanita" app via Bluetooth.
I have enabled the "Bluetooth HCI Snoop Log" developer option in my Android phone and ...
- 21
0
votes
1
answer
1k
views
Reversing DALY BMS BLE protocol
I am trying to communicate with the DALY BMS (Battery management system) via BLE.
I was wondering if anyone has any bit of information regarding their protocol, something to start with?
- 111
2
votes
1
answer
2k
views
Debug 3rd-party apk with .so-files missing debug symbols
Apologies, if this has been asked before. I am reverse engineering a chinese app that connects to a BLE device, so I can inspect how it transmits the data. Using this official guide I decompiled my ...
- 21
2
votes
3
answers
379
views
reverse engineering bluetooth smart thermostat payload
I am trying to reverse engineering an ENSTO "smart" bluetooth thermostat, which i just got installed in the house. The thermostat due to some technical and electrical challenges sometimes ...
- 123
3
votes
0
answers
175
views
Logitech UE (Mega)Boom Broadcast Audio
I am interested to build a tool which can stream audio synchronized to multiple UE Boom speakers.
UE (Mega)Boom speakers already have the ability to build up a broadcast/multicast domain to play audio ...
- 31
1
vote
1
answer
623
views
BM2 Bluetooth Car Battery Voltage Monitor protocol
I am opening this question, because it would be nice to create an open source app for this BLE voltage monitor:
https://www.aliexpress.com/item/32794632957.html
http://www.quicklynks.com/pro_show....
- 111
2
votes
3
answers
2k
views
CSR DFU File Format
I am trying to reverse engineer the firmware for my JBL Flip 3 speaker. I have obtained a DFU file for the device online but am unsure as to how much of the firmware is included. My first question ...
- 396
1
vote
0
answers
274
views
Decrypt ibt.sfi linux firmware(Intel Wireless 8265 Linux Bluetooth)
Why I want to decrypt:
Intel 8265 Bluetooth is likely a RAMUSB device, which needs system to update firmware. I try to transplant this linux firmware to macOS.
Problems I met:
The macOS BT firmware ...
- 11
3
votes
1
answer
2k
views
Sniffing serial Bluetooth traffic on Android
Related to UE Megaboom serial protocol: I am trying to get some insights on the serial protocol spoken by the UE Megaboom, which I suspect is how the app controls the advanced features of the speaker.
...
- 171
2
votes
1
answer
352
views
UE Megaboom serial protocol
I recently got a UE Megaboom Bluetooth speaker. Apart from various audio profiles, I noticed the speaker also exposes a Serial Port BT profile. I suspect this is the channel the app uses to control ...
- 171
-1
votes
1
answer
1k
views
How can I decompile the CC2650 .hex file to C?
I want to decompile it to C, or at least assembly the CC2650 hex file (Bluetooth Low Energy Sensor Tag), that provide TI.
My goal is to know the specific way used by CC2650 to generate the LTK.
I'll ...
- 103