Reverse-engineering case studies.

Node.js bridge that reads power and cadence from exercise bikes whose own apps or services are gone or closed, and re-broadcasts them as standard Bluetooth LE Cycling Power and Cycling Speed and Cadence sensors and as an ANT+ bike power profile, so that Zwift, TrainerRoad, bike computers and watches can use the bike. The author's development notes describe working out the Flywheel Home Bike's stats packets on its Bluetooth UART service after the vendor shut its home service down; Peloton support reads the bike's data cable through a USB serial adapter, while the Schwinn IC4 and Keiser M clients parse the standard Fitness Machine Service and Keiser's documented broadcasts. Bike and app compatibility is project-reported.

Python library that talks to Garmin watches over their proprietary GFDI V2 Bluetooth LE protocol, with no Garmin Connect, phone or cloud service. It implements the handshake, multi-link routing, COBS framing, CRC16 checks and protobuf service messages, streams typed readings such as heart rate, HRV, SpO2, stress, Body Battery and accelerometer data, and adds a simulator and recorded-session replay for work without hardware. Its acknowledgements credit Gadgetbridge for the protocol logic and schemas, while a published journal shows how the author decoded the accelerometer payload, which Gadgetbridge only logged, from labelled recordings.

Controls Bose headphones from Linux and macOS without the Bose app, account or cloud, through Python, Rust and C++ libraries and command-line tools that implement Bose’s BMAP protocol over Bluetooth RFCOMM. The author documents BMAP’s function blocks, operators, payload layouts and error codes in NOTES.md, reportedly worked out by probing RFCOMM channels, capturing Bluetooth traffic while changing settings in the Bose app and testing each operator, and the libraries cover noise cancellation, EQ, spatial audio, button remapping, profiles and device settings. Support is reported per model by the author and contributors.

Reconstructs the DUML-over-BLE protocol that DJI's Mimo app uses with the Osmo Pocket 3 camera as a Node.js library and CLI for scanning, pairing, gimbal commands and roughly 20 Hz position telemetry without the vendor app. The author reports working from a third party's Wireshark captures and dissector of Mimo traffic, a Go client and trial-and-error debugging; PROTOCOL.md documents the frame layout, CRC parameters, BLE characteristic roles and command IDs. A write-up and bundled patch trace seven bugs that kept the earlier node-osmo library from working with the camera, and the author reports that the patched library completed pairing, Wi-Fi setup and RTMP streaming.

Documents the Bluetooth Low Energy message format that DJI's proprietary MIMO app uses to control DJI Osmo devices, as artifacts produced while building the independent djictl CLI. The author derives the framing — a magic byte, length, protocol version, header CRC8, subsystem and message-id fields, a payload and a message CRC16 — from the author's own Android BLE logs, and ships a Wireshark dissector plus an annotated catalog of message types. Many message types are labelled as guesses or unknown; the author reports reaching working livestreaming on a DJI Osmo Pocket 3 and pausing further analysis.

Replaces the vendor phone app for the MXW01 “cat printer”, a small Bluetooth Low Energy thermal printer, with a Windows command-line client. The author reports starting from the iOS-only Moblin implementation and then reverse-engineering the vendor's phone app further, and the client sends CRC8-checked commands to one GATT service while streaming 384-pixel image lines in 1-bit or 4-bit grayscale. Several command IDs remain marked as unknown, and the author tested only this one printer model.

Reconstructs the A0 serial protocol of R2000-family 915 MHz UHF RFID desktop readers, which ship with only Windows software and an Android app, from the vendor app's native command encoder rather than its misleading Java SDK. A userspace CH340 driver, a Python CLI and GUI, and a small Android app then talk to the reader directly for inventory and tag-memory reads. docs/PROTOCOL.md records the frame layout, checksum, command table, response formats and the different field orders of READ and WRITE.

Documents the closed Bluetooth Low Energy GATT protocol of the Xiaomi Kettle, which the author reconstructed by decompiling the Mi Home Android app and disassembling its native encryption library. The write-up covers the connection and authentication handshake, the layout of status notifications and the writable settings characteristics, with a small Go reimplementation of the cipher helpers. The author built a kettle-to-MQTT bridge for Home Assistant from it but did not publish that code.

Documents the medium-speed CAN bus that links the 6000CD radio and the dashboard of a restyled (post-2006) Ford Fiesta MK5, worked out by tapping the bus at the radio's QuadLock connector with a Seeed CAN-BUS Shield on an Arduino Uno. The README describes 18 partly or fully decoded message IDs on the 125 kbit/s bus, with byte layouts and scaling formulas: radio text sent to the dashboard LCD over ISO-TP, station names, volume, CD track and steering-column mode and seek buttons, as well as broadcast clock, door, lock, reverse-gear, indicator, light, handbrake, airbag-lamp, pedal, RPM, speed, coolant, key-position, battery and partial VIN data. An incomplete Kayak .kcd definition encodes only the clock and gas-pedal/RPM/speed messages.

Decodes the undocumented Bluetooth Low Energy output of a Uniden R8 radar detector into a receive-only collector for a Raspberry Pi, with live telemetry, alert start/update/end events, SQLite history and optional MQTT and Home Assistant publishing. The author worked the protocol out from the wire on a real detector, building on earlier R8w findings from AegisX86/UnidenR8wlink, and grades every claim in PROTOCOL.md by its evidence: measured on this R8, seen on another model, decompiled from an app but untested, or inference. Unknown fields are carried through raw rather than given invented meanings.

Speaks the undocumented protocol of the Scanmatik SM3, a J2534 vehicle interface that otherwise talks only to its own Windows software, and exposes it to an Android phone as an ELM327 bridge with a diagnostics app on top. The author recovered the framing — a 16-byte header with sequence, CRC-based and sum-based check words, opcode and length — by capturing the device's bundled driver and measuring the replies, and docs/protocol.md separates what was established from what is still open. Reported results come from one Opel Astra J over five sessions with the car present.

Reimplements Apple Wireless Direct Link (AWDL), the proprietary Wi-Fi ad hoc protocol Apple devices use for peer-to-peer links such as AirDrop, as a user-space C daemon for Linux and macOS; the README calls it the result of reverse engineering by the Open Wireless Link project at TU Darmstadt's SEEMOO lab. OWL runs the master election, synchronises availability windows and the channel sequence, parses and crafts AWDL action and data frames, and provides an awdl0 virtual interface with a link-local IPv6 address, so unmodified IPv6 programs such as SEEMOO's OpenDrop AirDrop client can reach Apple devices. The authors describe the recovered protocol in a MobiCom 2018 paper.

QuestPad implements the Quest Touch controllers' private 2.4 GHz radio protocol on nRF52840 firmware so a computer can use them as a USB gamepad. Its protocol reference documents pairing, AES-CCM encrypted controller packets, 2 ms link frames and input data; the firmware exposes generic gamepad, DS4 and XInput modes.

Stadiacast recreates the network service used by the Stadia Controller's Wi-Fi firmware so the controller can connect to a local computer. The receiver answers boot and discovery requests, completes WebRTC and DTLS sessions, decodes input and sends rumble commands. Protocol notes record findings from firmware reading and live controller runs, with protobuf schemas and receiver code in the repository.

os-xgs-npu reconstructs interfaces to Sophos XGS appliance coprocessors through FreeBSD kernel modules and an OPNsense plugin. The work documents undocumented registers, PCIe device families and measured coprocessor behavior to expose front ports and offload firewall flows and IPsec associations.

LibreMP casts desktop screens to Epson EasyMP projectors using a protocol reconstructed from Windows client packet captures. Its Rust core handles registration and login messages, projector QR decoding, JPEG tile streaming and changed-region updates; a CLI and Tauri interface use the same core. The project documents control on TCP 3620 and video on TCP 3621.

Sony CDX-A250 LCD Panel reconstructs the serial control needed to drive the radio's detachable display independently through its LC75826W driver. Wiring notes, CCB transfer documentation, and an Arduino sketch cover display-data groups, control bits, test patterns, and experimental segment mapping.

MacroPad reconstructs the USB HID configuration exchange of a 12-key, two-knob macropad identified as 1189:8840 and implements it in a Linux GUI. The author documents capturing MINI_KEYBOARD.exe traffic with usbmon, decoding configuration and commit reports, and replaying captured packets in tests.

Monix implements Linux mixer control for Audient iD USB audio interfaces through a companion kernel module, protocol library and GUI. Its protocol documentation maps USB control requests from official-app captures and macOS binary analysis, covering routing, faders, metering and device profiles.

Scooter Link implements an Android client for Xiaomi Electric Scooter 5 Pro and 5 Max using a reconstructed BLE authentication protocol. Its research log covers GATT characteristics and investigation of the ECDH P-256, HKDF-SHA256, and AES-CCM exchange; the app reads ride and battery data and controls supported settings.

Sound Blaster AE-9 Linux support reconstructs card and Audio Control Module behavior using static analysis of Creative's Windows drivers and hardware observations. The included investigations document CtxHda.sys, CtxHdb.sys, and the ACM's SysEx-framed UART protocol; the driver implements selected playback and controls.

thermalmaster implements a Go USB client for ThermalMaster P3 and P1 thermal cameras using documented VDCMD control transfers. It captures PNG frames, streams thermal and IR video to Linux v4l2loopback, and records USB command framing and model identifiers for interoperability.

open-rknpu reconstructs a task-program interface for the Rockchip RV1103/RV1106 NPU from board experiments and black-box comparisons. Its Python compiler emits register commands, weight and quantization blocks, and a container for bounded static ONNX convolution graphs; a C runtime submits them through /dev/rknpu. Research files document register and numerical findings.

hardsid4u reconstructs the HardSID 4U USB protocol and implements a libusb Python driver for its SID-chip sockets. The investigation combines vendor-binary analysis, USB captures, and hardware probes to document command framing, initialization, register writes, timing, and flow control; a MIDI instrument uses the driver.

PyEilik implements control of an Eilik desk robot over a recovered USB serial protocol. Its C library and Python wrapper move four servos, read and update the 128×64 display, and play video with synchronized movement. The protocol reference documents 125000-baud framing, command IDs, checksums and acknowledgements.

libfprint-goodixtls reconstructs communication with the Goodix GXFP5187 SPI fingerprint sensor in the Huawei MateBook X Pro as a libfprint TOD driver. It reads a PSK from sensor RAM, establishes the sensor's TLS-PSK channel, decodes captured images, and uses local descriptors for host-side matching. The author reports enrolment and verification through fprintd and GNOME Settings; detailed reverse-engineering notes are kept outside the repository.

RazerStream replaces the retired control software for the Razer Stream Controller with a macOS app, Swift protocol library and CLI. Its documented device protocol runs over a USB serial port, performs a WebSocket upgrade, then exchanges framed commands and input events. The app configures touchscreen tiles, knobs, buttons and LEDs.

DABplay+ implements an Android DAB radio using a reverse-engineered USB dongle protocol. It drives the DTR-100 family directly, decodes broadcast data and audio, and documents additional dongle protocols alongside hardware findings and tests.

PocketPrinter5890 reconstructs the BLE printing protocol of Lidl's Tronic, SILVERCREST, and Parkside model 5890 pocket printers. Its specification documents activation writes, flow-control credits, and raster bands; Swift, Kotlin, and TypeScript libraries implement printing for Apple devices, Android, and browsers.

This parking-sensor investigation reconstructs the signal sent from a kit's controller to its display. Oscilloscope observations and tests with different sensor states identify fields in roughly 48-bit frames for sensor address, connection and proximity. A PlatformIO example for ATmega328P reads and reports the parsed frames.

pyhaseiq reconstructs the local WebSocket protocol of Hase iQ wood stoves used with the flamemonitor app and implements an asynchronous read-only Python client. The specification records base64-encoded request and response frames, serial dialogue and observation status for each finding; the client reads combustion phase, temperature and performance.

LED Controller uses BanlanX BLE commands to control SP611E-family LED strips from a desktop app. Its documentation maps GATT commands and state notifications, and reports probing an audio-feed message used by the controller’s music effects; included tools inspect advertisements, GATT state and Bluetooth captures.

Zemismart Blind Controller Protocol documents the 433.92 MHz OOK PWM messages used by Zemismart motorized blind remotes. It records pulse timing, payload fields and formulas for channel and button commands, with Python scripts to capture IQ samples and encode or decode transmissions.

vanmoof-certificates decodes the access certificates used with VanMoof SA5 and Series 6 bikes. It documents an Ed25519 signature followed by a CBOR payload containing bike serials, user identity, access role and expiry, and provides Go code to request, parse and check certificates. The source says the SA5 verification key was recovered from a bike BLE certificate.

Cosmic Byte Firestorm Controller implements a Linux client for the mouse's recovered USB settings protocol. Its Python CLI sends control and interrupt transfers to configure lighting effects, per-DPI indicator colours and sensitivity levels, while PROTOCOL.md records packet structures and command sequences.

Centerpiece Projects documents observed USB control messages for the Finalmouse Centerpiece keyboard and implements scripts around them. Its notes describe HID framing and message types for uploads, status, slot switching and preview chunks; PowerShell and Python helpers expose device operations.

FAAC E145 Gate Connect implements local control of an FAAC E145 gate through serial commands reconstructed from EasyBoard software traffic. The documentation lists POLL, OPEN, CLOSE and STOP byte sequences and describes their framing and checksum. The Python gateway adds position monitoring plus web, REST and MQTT interfaces.

stagg-net investigates the Fellow Stagg EKG kettle's internal UART interface and documents its connector, serial settings, observed heartbeat packet, and startup message. The repository includes a logic capture, decoder source, probing scripts, and ESPHome configuration for an ESP32-C6 connection.

TOZO Control provides a Linux GTK4 client for TOZO earbuds using a BLE GATT protocol recovered from the vendor's Android app. It sends commands to characteristic B611, receives notifications on B612, and documents GET and SET packet layouts and parameter IDs. The author reports testing the T10 model for battery, game mode, equalizer and balance controls.

BMS RS485 Service Suite documents an observed ASCII RS485 protocol for battery-management services and implements frame building and decoding in Node-RED. The specification covers framing, length and checksum fields, request and response rules and decoded service IDs; the wider suite connects JK and DALY BLE data to MQTT and dashboards.

Petkit Local replaces selected Petkit D4 feeder cloud exchanges with a local Home Assistant server and relays Eversweet Max 2 CTW3 fountain messages over BLE. The integration implements device registration, heartbeats, schedules, events and commands based on observed device communication.

IPI STAY FLY Driver reconstructs mouse configuration in a Windows app using reverse-engineered 16-byte HID frames. It exposes DPI, polling, button and sensor settings, documents a frame checksum, and includes a WebHID capture extension plus protocol notes for ATK FIERCE X.

A Soundcore D3200 investigation reconstructs the BLE exchange used to list and transfer encrypted recordings. Its Python client performs a P-256 ECDH handshake, derives session and file keys, decrypts AES-256-CTR Opus packets and writes an Ogg/Opus file.

K1 Pro OpenDeck Suite includes a Linux OpenDeck driver for the HOTSPOTEK/Mirabox Stream Dock K1 Pro based on its reverse-engineered USB/HID CRT protocol. The driver handles connection and keepalive messages, 64×64 JPEG key displays, RGB ring controls, and three knob inputs. Four accompanying plugins add generic OpenDeck functions.

iDotMatrix Home Assistant integration controls the HXS-002 / NL-XSD-32 LED panel over a BLE protocol derived from analysis of the vendor Android app. Its vendored protocol module and hardware-capture tests support power, brightness, clock controls and chunked 32×32 image uploads with CRC32.

Dell ControlVault 2 fingerprint on Linux adapts a locally obtained Broadcom driver to the older BCM5880 fingerprint reader through five signature-matched byte patches. The accompanying investigation maps the device’s USB endpoints, command header and driver checks. The author reports working capture, while enrollment and matching remain unreliable or unconfirmed.

epson-l3110-driver investigates the Epson L3110's USB printing exchanges while developing a Linux driver in C. Its notes use captured print-job traffic to identify the IEEE 1284 device ID, EJL session setup and ESC/P-R command framing. USB communication is still in progress, and the driver cannot yet print pages.

MS5 WiFi Microscope reconstructs the MS5 camera's UDP command and video protocol and supplies a Python client that serves its reassembled JPEG stream as MJPEG. The documentation specifies command headers, the OpenVideo port handshake, chunk layout and resolution queries; the author reports 1280×720 streaming at roughly 25–30 fps on MS5 hardware.

lux-lat-long-log reconstructs the Panasonic LUMIX S5 Bluetooth LE GPS exchange in an ESP32 camera client. The project documents GATT identifiers, session ordering and GPS/time packets from Android HCI captures, then uses a GNSS module to send positions without the phone app.

Magene L308 interop tools reconstruct the smart taillight's BLE control protocol and light_mode.bin pattern format. A protocol specification records GATT characteristics, command frames and upload sequences; browser, Python and Garmin clients use those findings to control settings and patterns directly.

xbloom-ble implements a Python client for the xBloom Studio coffee machine's recovered Bluetooth LE protocol. The author documents capturing app traffic and comparing GATT command frames; the CLI and terminal UI load recipes, program dial presets, optionally start brewing and display live scale telemetry.

ak820 implements macOS control of the AJAZZ AK820 Pro keyboard through its vendor HID feature-report protocol. The Python CLI sets the clock, RGB lighting, and sleep timer over USB; accompanying notes describe Windows-driver analysis, packet framing, transaction handshakes, and the unresolved key-remapping commands.

GameTrak Liberation implements a client for the GameTrak controller's reverse-engineered USB HID behavior. It sends the initialization and rolling-key keepalive messages needed for sustained reports, then exposes six-axis data through stdout, OSC, MIDI or WebSockets. Protocol notes, report captures and Processing and p5.js examples accompany the Python tools.

Cooper Hunter AC documents the COM1 UART and infrared control messages of CH-IF140RK and CH-IF140RK2 units with a Gree GRZQ3-R V1 board. The author inferred UART status fields by comparing packets while operating the infrared remote. The resulting ESPHome design receives UART status and sends control through an infrared signal path.

aw5d-linux drives the round LCD on an iBUYPOWER AW5/AW5D cooler from Linux using a 64-byte USB-HID output report. Its research notes document report ID 0x10 and byte positions for CPU usage, clock, temperature and gauge styling. The author reports a working display on one 3402:0407 unit; other device variants remain unconfirmed.

MyJBxHeadsetControl provides Stream Deck controls for the JBL Quantum 950 Wireless headset through its USB dongle's reverse-engineered HID exchange. It receives status packets for battery and sound modes, sends feature reports for settings, and uses the user's QuantumENGINE DLL to calculate EQ coefficients.

zlt reconstructs the LAN JSON API of the MTN ZLT T10D MAX router from its served JavaScript and observed responses. Its Python client handles reqproc requests, login and CSRF behavior, while a CLI and local dashboard expose signal, network mode, SMS and USSD operations. The protocol document identifies firmware-specific fields and porting limits.

claude-rc-api reconstructs the private HTTP interface used to control local Claude Code sessions from claude.ai/code. Its reference derives session endpoints, OAuth authentication, event envelopes, and streaming behavior from the CLI binary; a Python library and CLI use that interface to observe and steer sessions.

MSI Mystic Light on Linux implements lighting control for an MSI motherboard from USB traffic captured while MSI Center ran in a Windows VM. Its Python script sends a 290-byte HID Feature report to controller 0db0:0076, while the documentation maps modes, RGB palette bytes, brightness, direction and the flash-save flag.

LinkCam implements macOS menu-bar and command-line controls for the Insta360 Link 2 webcam. It uses standard UVC controls for pan, tilt and zoom, while its extension-unit investigation identifies a feature-mask bit and selector for AI tracking.

shark-k86-mac reconstructs the Attack Shark K86 keyboard's vendor HID controls as a Python CLI and library for macOS and Linux. Its clean-room protocol notes describe 64-byte feature reports, checksums and opcodes; the client controls lighting and the TFT screen and reads device information.

fitdays recreates read-only access to the Fitdays smart-scale cloud API from traffic observed in the vendor app. Its asynchronous Python client logs in with the service's password digest, follows regional redirects, renews sessions, and retrieves scale, profile, and body-composition measurement records.

trvision implements direct USB control of Thermalright Vision display panels using previously documented protocol research. It captures desktop frames, encodes JPEG or RGB565 according to the handshake reply, and sends framed data over bulk USB; a companion parser reads USBPcap captures.

pocket-client implements the Pocket voice recorder's recovered BLE command protocol in a Swift library and CLI. It documents authentication, status and recording inventory exchanges, MP3 transfer and control commands, using findings from vendor-app HCI captures and live device probes.

KeyAxis documents the HID travel stream of keyboards using the 0416:7372 controller and turns key depth into virtual gamepad axes. Its protocol notes specify the vendor interface, ARM and DISARM commands, 64-byte host reports and row, column and depth fields recovered from captured traffic.

The A.O. Smith water-heater project implements local monitoring and demand-response control of an HPS10-50H45DV over its CTA-2045 RS-485 port, publishing readings to MQTT. Its documentation records frame structure, checksums, control responses and observed behavior of this specific tank.

j2208-band-tools implements a direct BLE client for J2208-family fitness bands using protocol findings recovered from the FitTrack Health companion app. Its Python tools read stored health history and live sensor values, probe GATT services and collect readings into SQLite. The author checked the documented 16-byte frame protocol against one Hume Band V2.

Eufy Local Light implements a Home Assistant client for Eufy Outdoor String Lights E10 and Permanent Outdoor Lights E22 using BLE traffic analyzed from the Eufy app. Its protocol notes describe GATT endpoints, packet framing, AES-128-CBC session setup, and light-control commands.

OpenPeats reconstructs the SoundPEATS earbud control protocol for desktop and Android clients. Its specification describes frames and opcodes derived from analysis of the official Android app and checked against SOUNDPEATS H3 hardware. Go and Kotlin implementations expose ANC, equalizer and multipoint controls, plus battery status.

hongtai-panel implements Linux control of a LovingCool AIO cooler LCD using a USB CDC-ACM serial protocol reconstructed from the vendor's Electron application. Its documentation describes control-frame layout, checksums, JSON replies, and opcodes; the client displays system statistics, media, or screen mirroring.

An ESPHome component recreates L&S Emotion Control remote commands so an ESP32 with a CC2500 radio can control furniture lights and reflect physical remote presses in Home Assistant. Its documented radio configuration uses MSK at 2436.2 MHz, a sync word, and 14-byte payloads carrying the remote ID, command, and value.

akp02 reconstructs the Ajazz AKP02 secondary display's USB HID protocol as a Linux Python library. It documents command report framing and implements full or partial image updates, brightness and power controls, firmware queries, orientation and keepalive.

RK M75 reconstructs RGB control for the Royal Kludge RK M75 keyboard from wired USB HID captures and 2.4 GHz wireless experiments. A Python library sends per-key wired frames and grouped wireless frames; the repository also contains protocol notes, captures and a wired SignalRGB plugin.

ACiQ K18W documents the UART protocol between a mini split's indoor board and TCL WBR1 Wi-Fi module. Captures and decoders map 115200 8N1 traffic, 0xA5 frames, CRC-16/XMODEM, acknowledgments, and appliance fields; ESPHome configurations provide passive monitoring or local control after replacing the module.

RND Companion reconstructs the Cymaforma RND Synth's SysEx control vocabulary and implements a C++ codec and companion plugin for patch seeds. The protocol notes identify framing and seed or status commands from a web app and one hardware capture. The client can use a direct MIDI port or host MIDI routing and stores a curated seed library.

viture-v2 documents and implements the USB HID protocol used by VITURE Gen2 XR glasses. The author matched usbmon captures to SDK frame logs, then wrote a Rust driver with hidraw, usbfs and io_uring transports for queries and IMU streams. Measurements and compatibility claims cover the VITURE Pro 2 XR.

BikeStation is a local Windows client for Echelon Connect exercise bikes built on community research into their proprietary Bluetooth LE protocol. It reads cadence and resistance telemetry, queries the bike's resistance range, writes motorized resistance commands and records rides without the vendor cloud.

PartyBox for Home Assistant replaces the JBL PartyBox phone app's control path with a Bluetooth client and MQTT entities. Its documented protocol was reconstructed from the JBL PartyBox Android app 3.14.20 and observed traffic, including command frames over GATT and ATT over classic Bluetooth.

carlinkit-cxx implements a Linux host for Carlinkit Auto Box USB dongles using their framed bulk-message protocol. It receives CarPlay or Android Auto H.264 video and PCM audio, sends touch input and displays decoded video through VAAPI, V4L2 or software paths.

mchose-linux reconstructs the MCHOSE mouse settings protocol and implements Linux CLI and GUI clients for it. Its documentation traces HID feature-report commands and configuration fields from the M HUB web bundle and an L7 Pro mouse. The clients read and change DPI, polling rate, lift-off distance and other stored settings.

K1C CFS without official Creality firmware reconstructs part of the Creality CFS RS-485 control protocol so a K1C running a community Klipper stack can operate the filament box. Its Python client and Klipper extension cover discovery, addressing, sensors, RFID, filament feed and retraction; the combined toolchange macro remains unfinished.

Open TechEd reconstructs USB control of the Thermo Fisher NanoDrop 1000 spectrophotometer. The pilot captures vendor-software traffic, documents command and data endpoints, calibration reads, lamp and clamp controls, and pixel decoding, then implements a Python driver used through PyLabRobot.

douze reconstructs the Solid State Logic SSL 12 USB control protocol and applies it in a Linux command-line controller and local mixer interface. Its protocol notes and captures cover framing, checksums, gain routing, monitoring, preamps and loopback.

Osmotic implements a macOS client for DJI Osmo cameras using their BLE pairing, DUML-over-UDP control and file-list protocol. It downloads media over the camera's Wi-Fi, provides recording and live-view controls, and includes Swift protocol code and documentation derived in part from earlier Osmo projects.

GogglesView receives the DJI Goggles 3 live video feed over a reverse-engineered USB-C connection on macOS. It decodes H.264 with VideoToolbox and offers local viewing, passthrough recording and streaming outputs; the repository includes protocol research notes and Swift source.

Xiaomi X-WPFTB LiDAR documents the one-way UART data format of the X-WPFTB-V2.6.2 sensor used in Xiaomi and Dreame robot vacuums. The author reports decoding 36-byte frames carrying eight distance samples, angle, quality and flags, then implements an Arduino parser and Windows visualizers.

RedMagic Cooler for macOS reconstructs the REDMAGIC VC Cooler 6 Pro's Bluetooth control path in a menu bar app. It uses packet captures and vendor app observation to map GATT characteristics for cooling, fan speed, lighting and telemetry, and includes probe scripts for testing command bytes.

Panasonic HC-X2 / HC-X20 Remote Control implements a Python client for the cameras' HC-ROP/P2Control protocol. It sends XML control commands over TCP, decodes UDP telemetry and recording events, and documents the handshake and command set. The author reports testing it on HC-X2 and HC-X20 bodies.

open-m711pro reconstructs the Redragon M711 Pro mouse's USB HID configuration exchanges from vendor-app traffic captured with usbmon and Wireshark. Its Python Linux driver and interfaces read and set lighting, DPI, button mappings and polling rate through hidraw, with packet builders tested against captured bytes.

vestaboard-offline restores local control of a Vestaboard split-flap display with a Python web controller running on the board. It sends 6×22 character grids to the on-board vbctrl service and documents the display's RS485 flap-bus framing, commands and recovery path.

Better RGB reconstructs the USB HID lighting protocol of Tongfang laptops with an ITE8291 keyboard controller and implements a Windows per-key RGB client. The author describes comparing vendor-software captures with visible lighting changes to identify feature-report commands, output-report buffers and key offsets.

aiowapy implements a Python client for WhatsApp Multi-Device using Noise transport, Signal sessions and a WABinary codec. Its protocol notes describe framing, pairing and message stanzas; the code also covers media, groups, app-state sync and SQLite session storage. The author reports extensive offline tests but no live end-to-end message delivery yet.

redmi-buds-linux reimplements Redmi and Xiaomi earbud controls on Linux using a documented variant of JieLi RCSP over Bluetooth Classic RFCOMM. The author derived the challenge-response transform from the companion app's native library and compared protocol behavior with a phone-to-buds HCI capture. Its Rust CLI and GTK app expose battery status, EQ, gestures and earbud finding; noise control is available on models with ANC.

The iPod Classic LCD investigation maps the 34-pin display connector and decodes its 18-lane RGB666, 8080-series bus using logic-analyser captures and electrical measurements. It documents command framing, initialization, power sequencing and pixel timing, and includes Python tools to decode captures and reconstruct screen images.

obsbot-tiny3-protocol investigates direct USB control of the OBSBOT Tiny 3 camera. It documents UVC extension-unit addressing, V3 frame fields and CRC, Tiny 3 AI mode values, and command behavior checked against camera-reported state; Python probes inspect UVC properties and test vendor opcodes.

StargateCryo is a Rust dashboard that monitors and controls Intel Cryo cooling controllers over a documented reverse-engineered serial protocol. It adds controller telemetry, PID profiles, diagnostics, session history, and sensor integrations to an earlier open-source controller. The documented hardware evaluation covers one modified Gen 1 controller with a Gen 2 TEC.

infrared documents command mappings for LG 6710CMA family and Vityas RC-5 remotes through LIRC and irplus configuration files. The LG notes describe the 0x0808 pre-data, a possible 38.3 kHz carrier and a 256-code command space; a full irplus configuration lets readers try that space against compatible devices.

Winbond Keyboard Colour implements lighting control for Winbond-based keyboards on Linux using USB command bytes mapped from the original Windows software. Its graphical interface lets users select and apply lighting effects.

OBOX Controller ViGEm Driver implements a Windows client for the Snail OBox Bluetooth gamepad using a documented HID protocol. Its Rust driver maps buttons, sticks and triggers to a ViGEmBus Xbox 360 controller and sends rumble and LED commands through HID output reports; the repository also includes a Python prototype.

An OsmoFresh Quella Pro investigation records reconstructed PCB schematics, identified components and a UART communication model for the water dispenser. The protocol notes distinguish main-to-display responses from display-to-main AA frames and give a SUM16 calculation, while leaving several payload meanings unresolved.

Colorful 2F4C:1018 reconstructs the HID commands used to drive a COLORFIRE motherboard's ARGB headers from vendor-app analysis and live probing. It identifies interface 2 as the lighting channel and documents 20-LED data reports followed by commit reports. Included OpenRGB controller code sends direct frames and host-rendered effects.

Deli XiangYinBao X1 reconstructs the portable label printer's proprietary Bluetooth printing protocol from HCI captures and Frida observations. It documents CRC32 framing, 384-dot bitmap encoding, replies, and print sequencing, with Python and JavaScript implementations, capture parsers, and regression tests.

KardiaMobile 6L Unlocked reconstructs the BLE exchange used to obtain ECG samples from the AliveCor KardiaMobile 6L. Android HCI captures inform the bonding sequence, derived unlock token, and two-channel sample framing; a Python client records the stream on Linux and writes CSV, PNG, and PDF outputs.

Elan 04f3:0903 reconstructs a laptop fingerprint sensor's USB interface after analysis of its Windows driver DLLs and provides a Linux capture and authentication pipeline. The source identifies command, touch and raw-frame endpoints, then describes OpenCV preprocessing, ORB features and RANSAC matching for a PAM integration.

FIIL 耳机控制 implements a Windows client from reverse-engineered BLE GATT commands used by FIIL headphones. Protocol notes describe the fdb3 service, ff17 write and ff18 notification characteristics, message framing, unlock sequence and command responses. The desktop app controls supported modes and records raw traffic alongside parsed results.

Wireless AA Bridge reconstructs a wireless Android Auto relay on a spare Android phone. It presents a USB AOA connection to a wired car head unit, performs Bluetooth and Wi-Fi projection setup with the client phone, and forwards AAP traffic while preserving its in-band TLS exchange.

atmos-lcd is a Windows client for the Cooler Master MasterLiquid Atmos II LCD built around a reverse-engineered USB HID protocol. It controls screen content, brightness, rotation, and stored media; the repository documents handshake and command framing and includes a C# probe and packet-capture parser.

B&K 2318 documents measured behavior of a vintage thermal printer's ZI 0054 serial interface, including XON/XOFF flow control, text commands, character sets, and graphics. An ESP32-C6 and SP3232 adapter connects a modern computer to the unmodified printer; the repository includes firmware, a Python client, probe scripts, and logs.

TCOMAS LG600 reconstructs the USB HID image-transfer protocol of a 480×480 cooler LCD from vendor-app traffic. Its Python package encodes images as JPEG, splits each frame into HID output reports, and streams them to the display. The documented report format and timing constraints are based on one tested LG600 unit.

Wanderer implements control software and a data plotter for an Elektrobit/Extrabit portable sensor device from around 1991. The author says the unit they examined measures ambient temperature and vibration, and reports reversing its serial protocol and reimplementing parts of the original Windows control software in Python.

Clockwise Calipers Data Interface reconstructs the DTCR-02 data cable for Clockwise Tools DCLR-XX05 calipers. An Arduino reads the caliper's synchronous 24-bit measurements and presents them as USB keyboard input; the repository includes packet notes, firmware, KiCad designs and case models.

pocket_polar investigates command bytes for a WOOSIM PORTI-SM40 Bluetooth receipt printer. Python scripts pack style, alignment and image commands and write them to a Bluetooth serial device; the image path is marked unfinished.

autowonder-claude-executor reconstructs AutoWonder's scheduler-to-executor interface in a Node and TypeScript daemon that runs Claude Code for dispatched tasks. Its specification covers WebSocket dispatch frames, package checks, inventory heartbeats, handoff, checkpoints and crash recovery.

LocalAC reconstructs local control of a Gree Pular T3 air conditioner through its LAN protocol. The author documents UDP port 7000 discovery, a bind handshake, AES-GCM command envelopes and property behavior measured on one firmware version. A C# protocol library supports a CLI and .NET MAUI app for status, temperature and other controls.

Panoptes reconstructs the encryption layout of Hik-Connect live video streams for a self-hosted Hikvision DVR video wall. The author compares clear SPS data in SDP with encrypted in-band SPS, reports AES-128-ECB with the device verification code as key, and implements per-NAL decoding in an RTSP client that feeds go2rtc.

mchose-linux reconstructs MCHOSE A5 and AX5 Pro mouse settings on Linux from a decompiled Windows driver. It documents 65-byte HID Feature Reports, command groups and field offsets, then provides DPI and polling-rate controls, battery status and other settings through a CLI, GNOME extension and GTK app.

epson-scan-to-mac reconstructs Epson's Scan to Computer exchange for Macs from captured printer and Event Manager traffic. A Python listener answers SLPv2 discovery and PushScan requests, then asks Epson ScanSmart to scan; a separate WSD listener can save JPEGs directly. The protocol notes document the observed message flow and bytes for an EPSON L6270.

OpenMouse implements a macOS client for the Kysona M600 V2 mouse from recovered HID control messages. The author derived framing and checksums from the vendor's Windows library, refined the protocol with USB captures, and wrote Swift code for settings such as DPI, report rate and button mapping.

WDA Konfigurator reconstructs the configuration client for Microsoft Wireless Display Adapters. The author derived its CGI request protocol from original-app traffic and app inspection, then built a Windows GUI and CLI for settings and official firmware installation. The documented protocol covers commands, discovery, errors and firmware transfer for Gen 1, Gen 1.5 and Gen 3.

irca-ble-protocol documents the Bluetooth LE control protocol observed on an Olle POWER-family towel rail. It describes GATT characteristics, 20-byte command frames, status fields and authentication behavior, and provides Python, Home Assistant and Android implementations.

egm6-nixie-clock reconstructs the EGM6 six-tube clock's Wi-Fi control protocol from vendor Windows-app traffic. Its Python CLI sends TCP port 10000 frames for display, time, effects and scheduling settings. The README records the frame layout, command groups, sample bytes and unresolved groups.

Guoran nixie clock documents the BLE control protocol of GANXIN IN1204M family clocks and implements it in a Web Bluetooth app and Home Assistant integration. The author derived the commands from the original Android app and the clock manual; the protocol document records GATT characteristics, message handling, and open questions.

1st Player RT LCD reconstructs the USB HID control protocol for displays in 1st Player RT5, RT7, and RT9 cases. Its protocol notes describe 64-byte output reports, and Python scripts drive CPU and GPU telemetry, scrolling text, and a panel test on Linux.

Ecovacs Deebot X1 Local Control Research documents the robot's map format, ROS messages, state stream, and control services for local operation. The repository includes captured message definitions, scripts for querying and calling the ROS graph, and deployment notes for a separate Valetudo fork. The author reports working map, cleaning, and settings control on an X1 device.

MyEnergy Dashboard reconstructs Bluetooth control and telemetry for the INFINITY 1000 portable power station in a browser app. Its TypeScript protocol package builds frames, checks Modbus CRC, decodes device messages and runs a simulator, while the web interface exposes power readings and controls.

sk700v-linux drives the Sudokoo SK700V cooler LCD from Linux using its observed USB HID protocol. The write-up maps 64-byte output reports, command payloads and sensor fields from vendor-app traffic and trial frames; a Python daemon sends CPU readings and a probe script sends manual frames.

OpenNoiseRep implements a BLE client for the Noise REP band, with desktop, menu-bar and command-line views for historical health data and local CSV or JSON export. Its protocol notes reconstruct GATT characteristics, chunk framing and commands from a vendor sync capture and live probing.

rtchair reconstructs local control of the Rotai RT7709S massage chair from its communication protocol. An OpenWrt router redirects the chair's MQTT connection to a local broker, while a CLI and Home Assistant integration expose controls and timed massage programs.

zte-cpe-sms reconstructs access to the internal SMS API of ZTE MC889 and related 5G CPE devices. Its protocol notes describe login hashing, an RSA session-key exchange, a token that must be recalculated after key exchange, and UCS-2 message encoding; Node.js CLI and web clients use those findings to read and send SMS.

gs5-rgb reconstructs the Creative Sound Blaster GS5 lighting protocol from USB captures and implements it as a Linux Python library and CLI. Its protocol notes specify HID report framing, acknowledgments, effects, and status reads; the client controls seven strip segments, brightness, and built-in effects.

Telly Remote controls a Telly TV through a Flipper Zero that emulates the TYRC-1 remote over Bluetooth HID and infrared. Its documentation records captured NEC extended infrared codes, Bluetooth advertisements and scan responses, and the PnP ID that selects the TV's key map; a local web server sends keys and menu sequences to the Flipper.

Wave Buds implements an Android companion for the original JBL Wave Buds using a Bluetooth control protocol documented from the author's traffic captures. It controls ambient sound, equalization and touch settings, and its reference records GATT characteristics and command frames.

manifold-558s-ble reconstructs the testo 558s refrigeration manifold's Bluetooth LE message format from observed traffic between the device and its phone app. Its Python client subscribes to live pressure and temperature measurements, while companion scripts inspect GATT services and decode Android Bluetooth captures.

attackshark-x11prov2 reconstructs the ATTACK SHARK X11 PRO V2 mouse's HID configuration exchanges and implements a Python CLI for DPI stages, polling rate and lift-off distance. The documented report layouts include the LOD byte, checksum and read and write acknowledgments.

AULA Hub reconstructs the AULA F99 Pro keyboard's wired and 2.4 GHz HID commands and uses them in a Windows control app. Its protocol notes describe frame layouts, configuration pages, key records and per-key colour data; the app provides lighting, remapping, macros and battery display.

hpcs330 implements a Python reader for the Hopoo HPCS-330 spectrometer using a USB serial protocol recovered from the vendor's Windows application. The protocol notes describe framing and measurement commands; the client retrieves spectral samples and the meter's computed light measurements.

LB-M8 Settings implements a browser client for the Lingbao M8 mouse using HID commands recovered from its Windows driver. A byte-level protocol reference describes 40-byte feature reports, request and reply behavior, and settings for DPI, polling rate, sleep, and sensor options.

iMist implements local Home Assistant control for an aroma diffuser whose Bluetooth command format was inferred by observing reports while its buttons were pressed. Its protocol notes map the fff4 characteristic's aa MM LL mist and light bytes; the integration exposes state, color, mist, schedules, and a sleep timer.

Toshiba e-STUDIO2323AM/2823AM CUPS driver reconstructs the printers' PJL and JBIG-1 print stream from captured Windows GDI driver output. A CUPS raster filter and PPD generate jobs for a socket print queue, while protocol notes describe job envelopes, page blocks, paper options, and copy behavior. The author reports byte-level capture comparisons and printing on an e-STUDIO2323AM.

CustomWatch implements an Android companion for the Prixton Life Fit smartwatch using a BLE protocol studied through static analysis, limited capture and one-device tests. It requests activity, pulse and battery data, stores sleep observations locally, and forwards selected notifications.

reticos-rgb reconstructs the Speedlink RETICOS RGB mouse's HID profile protocol from a capture of its vendor driver. Its Python tools read and back up the onboard profile, change lighting, DPI and polling settings, and decode exported .bkm profiles. The documentation maps feature reports and selected profile bytes.

SPL Lab Web replaces the measurement functions of the NEXT LAB bass meter's Windows software with a Node service, browser interface and Electron app. Its device protocol document draws on Ghidra decompilation, configuration files and live tests; the client reads USB serial data, computes measurements and exposes an HTTP/SSE API.

SainSmartDDS140 reimplements control of the SainSmart DDS140 USB oscilloscope through its recovered USB protocol. The author describes decompiling the vendor .NET app, examining its WinUSB wrapper and checking commands against hardware. A pyusb client exposes capture, calibration, recording and a local browser interface, while protocol notes document control transfers and interleaved channel samples.

haylou-rt-tools reconstructs selected Haylou RT LS05S watch interactions and the .tbwf watch-face format from device observation and study of the Hello Haylou app. Its Python tools query firmware and battery status, pair with the watch, show a text alert during pairing, build and check faces, and preview main text elements. The protocol notes specify BLE services, frame checksums, and command IDs.

A DJI RC Plus 2 investigation reconstructs its control-report protocol and maps the handheld’s sticks, wheels and buttons to gamepad input. The Android library decodes DUML reports, a tester displays live controls, and a Java SDL3 bridge presents them as an Xbox-style controller. Protocol notes give frame layout, checksums, keepalive and report rates.

AK820 Center implements a Linux configurator for the AJAZZ AK820 Pro keyboard using a vendor HID protocol recovered from the Windows DeviceDriver.exe. Its protocol notes describe 65-byte feature reports, transaction framing and command banks; the Qt application controls lighting, remapping, macros and TFT uploads over wired USB.

Komimi reconstructs the Redmi Buds 6 Lite control protocol and uses it in a Windows tray client for battery status, noise control, and equalizer presets. Its protocol reference describes RFCOMM transport, framing, and commands, with a reusable C++17 message implementation.

The Fisher & Paykel RF505BRNUX1 bridge decodes two 9600-baud serial links on the refrigerator's main board and exposes door, setting, compressor, defrost, and temperature states to Home Assistant. Its documentation specifies frame layout, CRC-16/MODBUS, addresses, and byte maps; an ESPHome configuration reads the links without transmitting.

Lightstick Vibed Studio reconstructs BLE control of the Super Junior Ver. 2 lightstick from study of the SMTOWN Android app and checks on hardware. A local FastAPI console scans the device, sends color and effect commands, and offers a byte-level packet lab. The repository also contains a protocol specification and an Android client awaiting hardware BLE testing.

IOTBT701 BLE LED Strip applies the protocol from the open-source lednetwf_ble integration to a Zengge-family Bluetooth light strip, checks it against the physical device and implements Windows C# clients. The notes describe GATT service FFFF, command characteristic FF01, status characteristic FF02, power and v3 color frames, plus device-specific hue behavior. A GUI maps screen color to the strip.

The Heat & Glo RC300 Homey app reimplements 433 MHz commands from the IntelliFire Plus RC300 fireplace remote. Captures made with Homey's RF recorder inform a documented 47-symbol frame layout; the app learns the user's remote address, sends on/off, flame, and fan commands, and receives remote state changes.

An Arduino sketch reconstructs control of the APC SU1400RM2U display panel from its cable pinout and LED mapping. It identifies the A6276ELW LED driver, assigns latch, clock and serial-data lines, and demonstrates individual and sequential LED updates.

Silverbud implements a Windows manager for Galaxy Buds3 over Samsung's RFCOMM control channel. It parses framed status and battery messages and sends settings commands for noise control, equalization and finding earbuds; its protocol notes credit GalaxyBudsClient for base layouts and document Buds3 observations.

hiska-keg450-lcd reconstructs Linux control of the HISKA HX-KEG450 keyboard from vendor HID traffic captured under Wine. Its Python client sends images, animation, lighting, settings, and clock commands through hidraw, while protocol notes specify report sizes, opcodes, acknowledgments, and upload sequences.

week-aqua-ble reconstructs the Week Aqua P1200 Pro aquarium light's BLE commands by decompiling the Android app and recording its writes to a simulated light. ESPHome configurations use the recovered messages for channel brightness, fan, clock and schedule control through Home Assistant.

etnga-obd maps the OBD-II diagnostic surface of Toyota eTNGA vehicles, including the bZ4X, Subaru Solterra and Lexus RZ. It records UDS over ISO-TP addresses, gateway sub-targets, decoded telemetry formulas and selected broadcast CAN frames, with confidence levels for individual findings.

DMR-39 Remote Bridge reconstructs remote control of the SUPER DMR-39 set-top box by probing its I2C front panel and capturing NEC infrared signals. The resulting ESP32-C3 firmware and Python tools expose mapped buttons through a web relay, with HDMI capture used to observe responses. The author reports mapping all 41 remote buttons.

open-drong-display replaces the Drong Display 1CBE:0003 dongle's Windows software with an IddCx display driver using a reconstructed USB protocol. The project documents bulk-transfer commands and session startup, then sends H.264 frames to the dongle for HDMI output.

INNO X2 for macOS reconstructs configuration of the VortexSeries INNO X2 PRO mouse through its vendor HID feature reports. Its Swift app sets DPI, polling rate, buttons and macros, and shows battery status; the notes document 64-byte packets, checksums, receiver exchanges and opcodes.

pro2-linux reconstructs configuration of the Logitech G PRO 2 LIGHTSPEED mouse on Linux from its HID++ 2.0 exchanges and onboard profile format 0x07. Its Python tools and libratbag patch handle DPI, report rate, RGB and button settings, while protocol notes record feature IDs and report layouts.

beam-revival reconstructs local control of the Suitable Technologies Beam+ telepresence robot after its cloud service ended. Its Python stack implements the documented motor-board serial protocol and provides browser driving, camera video, audio and docking, plus tools to build a bootable USB image.

NXOSC Reborn reconstructs the Waves Nx Head Tracker's BLE communication from analysis of Nxosc and captures from a physical tracker. Its Python app decodes orientation packets and sends configurable OSC messages to spatial-audio software, with profiles, smoothing and adjustable output rate.

BLE LED Matrix Controller investigates the BLE commands of an ATOTOZONE CI-VIALD19 96×20 LED matrix and supplies a Python uploader for GIFs and static images. Its notes record packet acknowledgments and commands for brightness and screen blanking; the author reports successful GIF uploads below 49,980 bytes.

LSC Smart Connect / Battletron reconstructs the desktop application's LAN lighting protocol in a Rust bridge for SignalRGB. It supports QR login, authenticated local color streaming and device management, with a JavaScript and QML plugin for the SignalRGB canvas.

Razer Key Light Chroma adds local RGB control to SignalRGB using the lamp's documented TCP and UDP message sequence. It performs acknowledged setup on TCP port 10003, streams 95-byte color packets on UDP port 10005, and includes fixtures and tests comparing packets with the original SDK.

lochinvar-native-modbus reconstructs the read-only Modbus register map exposed by Lochinvar Knight boilers through the SMART SYSTEM display's USB PC Connection port. Probe scripts and display comparisons identify telemetry for temperatures, firing rate, flame signal and counters; ESPHome and MQTT bridges publish readings to Home Assistant.

Cindy Band implements PC and Android clients for Xiaomi Smart Band 8 NFC using a documented BLE protocol. The project records FE95 GATT framing, cmd26/27 authentication, HKDF session keys and AES-CCM business frames, alongside a local server and MCP access to band functions.

hd60-macos recreates host control of the original Elgato Game Capture HD60 on macOS from USB traces of Elgato's application. Its libusb driver uploads a user-extracted firmware image, replays trace-derived I²C initialization sequences, and streams H.264 video and audio as MPEG-TS to stdout, UDP, or OBS.

Lumalou Revival reconstructs control of the Fisher-Price Lumalou lamp after its app was discontinued. An ESPHome bridge and Python client implement the documented MPID BLE exchange, including ECDH session setup, AES-128-CTR packets and framed sound-and-light commands. The reference lists 68 opcodes; the author reports testing on one lamp.

openedu09 reconstructs control of the Whadda WSEDU09 USB oscilloscope from analysis of the vendor software and captures from a real device. It implements the HID protocol in a Python driver, GUI, calibration tools and an MCP server that lets agents acquire and measure signals.

Tonebook documents and implements MIDI control of the LIVTRA NanoCore guitar pedal from a browser. Its protocol notes map the documented control messages and observed SysEx framing used by the vendor app to name and save presets. The site applies song tones, adjusts parameters live, and stores presets on the pedal after confirmation.

Resonance reconstructs Sony headphone controls in a Windows app using a documented Bluetooth Classic MDR protocol. Its core library and CLI implement framing and commands for noise control, equalizer, battery, touch settings, and device switching; the protocol notes distinguish app-derived fields from device observations.

AtomFast → ESP32 → Web UI implements a read-only BLE gateway for AtomFast dosimeters. ESPHome firmware parses a 13-byte measurement payload into count rate, dose, battery and temperature readings and publishes them in a browser; protocol notes map GATT characteristics and payload fields.

moldqueen controls Mould King building-block toys by encoding commands as BLE advertisements derived from a reconstructed device protocol. Raspberry Pi, Android and ESP32-S3 radio cores expose a shared WebSocket API to a browser client; the Mould King 13112 excavator is the documented hardware reference.

DJI RC Joystick Bridge reconstructs the stick-value exchange of a locked DJI RM-series controller over its DUML USB interface. The Python client polls command set 0x06, command 0xf5, decodes four little-endian axes from the payload and exposes them as a Linux uinput gamepad.

Minisforum MS-A1 EC fan / temperature driver documents the embedded controller's sensor command exchange and implements a Linux hwmon module for CPU temperature, board temperature and three fan RPM readings. The investigation records direct port I/O at 0x6C and 0x68, the 0xDD temperature and 0xD5 fan commands, and a command sweep used to examine the available interface.

NFC PM-Pro reconstructs the FURUI NFC PM-Pro reader's USB HID command exchange and implements a Linux GUI and CLI around it. The protocol notes describe report framing, RC4 encryption, CRC-16 and device commands; the client reads, writes and clones supported RFID cards, runs dictionary, nested, darkside and hardnested key recovery, and handles dumps and NDEF records.

RF Power Meter V5 Companion reconstructs the USB RF Power Meter V5 serial exchange and uses it in a Windows monitoring app. Its protocol notes describe 460800 8N1 communication, calibrated dBm records, burst markers, and device settings; the author reports comparing live captures with an IL decompile of the vendor executable.

miband-lit implements direct BLE communication with a Mi Band 5 to authenticate, stream heart-rate readings and send notifications or vibration commands. Its write-up describes the band's 16-byte key and AES challenge-response exchange. A Streamlit dashboard displays readings, while an optional WiZ bulb integration reacts to them.

zafro-ha-local replaces the cloud endpoint used by a Zafro A9092R air conditioner with a LAN server. Its protocol notes derive the device's REST login, MQTT 3.1 WebSocket messages, topics and state commands from captured traffic. The Python service handles the device connection and publishes Home Assistant entities through MQTT Discovery.

open-apt-flash reconstructs the UART bootloader exchange used by APT Burn Tools to flash the APT 860C e-bike display. Its Python library, CLI and GUI implement 57600 8N1 communication, page framing, checksum, acknowledgments and a sync handshake. The author reports comparison with original-tool traffic and a complete flash on a live display.

MADLIONS 60 Configurator implements a Windows client for the MAD60 keyboard using USB HID commands reconstructed from vendor web app traffic. Its device layer builds configuration reports and reads settings back from the board; the interface covers per-key lighting, animations, Hall Effect settings, and profiles. Capture helpers support investigation of other models.

ax206-usb-display-macos implements macOS control of a QDtech AX206-derived USB display. Its Python driver sends RGB565 frames through USB Mass-Storage Bulk-Only framing and the device's BLIT command; an image viewer and live system dashboard use that driver.

An MQTT-to-BLE bridge that controls the SP542E LED controller from Home Assistant using BanlanX_6xx commands. Its protocol notes identify service FFE0, write characteristic FFE1, plaintext 53-prefixed frames and acknowledged writes for power, white color temperature and brightness.

ESPHome — Technibel SCDF32C5I IR Climate reconstructs the air conditioner's 48-bit infrared command format from raw captures. Its protocol notes map frame fields and checksum behavior, while an ESP32 frame builder and ESPHome configuration send commands through a Home Assistant climate entity.

Atomberg BLDC IR Remote implements an Android infrared client for Atomberg ceiling fans using 38 kHz NEC commands. Its command table covers power, speed, boost, timer and sleep; the author reports recovering a working Sleep code after an earlier published value failed on an Erica Meta fan.

GameGent is a Linux client for configuring GameSir Tarantula Pro controllers through a reconstructed USB HID exchange. Its protocol notes derive packet fields from the vendor Electron app and a Ghidra-decompiled DLL; the CLI reads state and mappings and sets lighting, sticks, motion controls, remaps and rumble.

xgecu-t48-reverse reconstructs the XGecu T48 programmer's eMMC USB exchange from Xgpro.exe analysis and captured device traffic. Its notes describe command opcodes, endpoint roles, bulk transfers and ISP settings; Python examples read and write eMMC through the T48 adapter.

The Miele XKM3000Z bridge decodes local Zigbee telemetry from an older Miele washing machine and publishes status, program, timing, and door events through MQTT for Home Assistant. Its protocol notes map endpoints and clusters, including the raw 0x0B02 event cluster and parameter blocks.

PolyWollyWin controls the ASUS ROG Strix Flare II Animate keyboard's AniMe Matrix through a USB HID format confirmed from captures of the official software. The Windows app sends 312 LED values in a documented report and provides effects, image playback, and a paint editor. The repository also documents hardware porting.

gloriousctl adds Linux control of Pixart Model I 2 mice through a hardware-mapped, write-only HID report format. The author documents corrected DPI, stage color, polling-rate, and fragment timing fields, alongside a CLI and GTK front end.

divoom-protocol implements a Python BLE client for Divoom Backpack M and TimeBox-Evo-audio displays using reconstructed framing and command sequences. Its documentation covers session initialization, brightness, channel switching, image frames and animation upload, and identifies commands that remain undecoded.

hestia reimplements the Keemple gateway's cleartext 0x7e-framed protocol for local smart-home control. A specification derived from observed LAN traffic covers framing, TLVs, handshakes, device commands and reports. The Python server operates as a decoding proxy or a standalone cloud replacement, with a web dashboard and local automation.

gigabyte-gpu-lcd reconstructs I2C control of the LCD on a Gigabyte AORUS GeForce RTX 5090 MASTER ICE. Protocol notes derived from Gigabyte Control Center components map 256-byte commands, display modes, and image uploads; a Python library and CLI send static screens and RLE animations on Linux.

Ricoh SP 200 Linux CUPS Driver reconstructs the printer's USB print exchange from captures of its Windows driver. Its notes identify PJL commands around JBIG1 raster data, document page transitions and image chunking, and accompany a C filter that converts CUPS raster input into the observed job format.

HyperX QuadCast 2 S RGB control implements a macOS client for the microphone's USB HID lighting exchange. The source documents seven-packet color updates, acknowledgments, upper and lower LED zones, and IOKit collection selection and response draining. The app controls solid colors and brightness through a menu bar interface.

whoop4-ble reconstructs direct BLE access to Whoop 4.0 sensor records in a Python client. It documents command framing, CRCs, historical-data draining, and a five-byte SET_CLOCK payload that the author reports fixes stalled flash recording; tools export HR, RR, and accelerometer samples and monitor packets.

MSI Mystic Light RGB Web Control Panel reconstructs USB HID lighting commands for the MSI PRO B760M-A DDR4 II motherboard. Captures from MSI Center inform its 185-byte Feature Report layout, enable bit and two-packet send sequence; a Linux Flask service exposes zone controls in a browser.

Open Trofeo LCD drives the Thermalright Trofeo Vision 9.16-inch display from Linux using documented USB transfers. Its notes combine the project's captures with prior trcc-linux work to describe initialization, JPEG frame chunks, and acknowledgments. A native PyUSB path feeds a dashboard with themes, system telemetry, media, weather, and game statistics.

Soundpeats Mini Pro HS Controller rebuilds earbud control through a Kotlin Android app and Python tool using reverse-engineered Bluetooth SPP commands. It queries battery and mode state and sends ANC, touch, game-mode, and seven-band EQ commands, including 17-byte packets for individual EQ bands.