Reverse-engineering case studies.

breezyd implements local UDP/4000 control for Vents Twinfresh Breezy 160 and Elite 160 Pro ventilators. Its Go library, CLI and daemon read sensors and set operating modes, while retained Python probes and snapshot diffs document how vendor-app actions were mapped to device parameters.

ebkn-m61-protocol documents communication with EBKN and Realand BioFace M61 biometric access terminals and supplies a Python reference listener. Its specifications cover WebSocket with XML messages, FkWeb HTTP posts with JSON, and raw TCP XML streaming, including attendance events and supported command exchanges.

Divoom Times Frame research maps parts of the photo frame's cloud and local HTTP command interfaces and provides Python probes for login, photo listing, file upload and local display control. The author reports that the command binding an uploaded photo to the frame remains unknown; RongCloud messaging is a hypothesis.

labelwriter implements TypeScript drivers for DYMO LabelWriter printers around a shared command-encoding core. Its documentation covers LW raster, LW5 raster and Duo tape wire protocols, while Node USB/TCP and browser WebUSB packages deliver print jobs to supported devices.

jl-dv-viewer reconstructs the local streaming exchange of Jieli-DV-style Wi-Fi rearview and dash cameras in a Kotlin Android viewer. It sends length-prefixed CTP control messages over TCP, reassembles custom UDP chunks into MJPEG frames, and documents the command vocabulary and frame format. The app also offers crop, rotation and reconnection controls.

picoscope-libusb reconstructs PicoScope 2204A USB control from SDK traces and device experiments. Its protocol notes document endpoints, command framing, firmware upload, capture modes, and waveform transfers; a C libusb driver exposes these functions to a Wails desktop GUI and an Android JNI library. Firmware blobs must be extracted from the user's own device.

pyPredator reconstructs RGB control for the Acer Predator PH18-73 keyboard from PredatorSense USB captures. Its Python program streams 128 main-key and 16 WASD-zone pixels through documented USB control and bulk packets at 30 Hz, with a Tk GUI for effects. Ring, logo and underglow control delegates to a separate CLI submodule.

FT9201 Linux documents the USB exchanges needed to poll finger presence and capture a 64×80 grayscale frame from a FocalTech FT9201 reader. A C libusb proof of concept follows the recorded control-transfer and bulk-IN sequence and writes raw and PGM images.

SP656E CLI implements a Bluetooth Low Energy client for SP656E and SP638E lighting controllers using the documented BanlanX 0x53 command format. Its Python interface scans devices, reads status and sends power, color, brightness, effect and raw commands; the protocol basis is credited to earlier community research.

Navico GoFree records screen-mirroring protocol behavior observed on a Simrad NSS12 evo3 marine display. It maps UDP multicast discovery at 239.2.1.1:2052, the TCP connection on port 6633 that enables video output, and the RTSP /screenmirror endpoint, with small client probes.

The Claude Code inbox-socket project documents the internal session messaging protocol carried over a Unix socket or Windows named pipe. It describes JSON-line frames, transport, receipts and delivery behavior, and supplies client examples and conformance checks against installed Claude Code versions.

Fujitsu FGL Type A Bus Protocol reconstructs BWR wired-remote messages of an older Fujitsu/General air conditioner from logic-analyzer captures. Its specification records 500-baud 8E1 framing, heartbeat and command frames, and temperature and fan encoding; Python tools decode stored captures or sniff the bus live.

The UniFi Protect audio investigation maps private HTTP endpoints and a WebSocket talkback stream for a UNVR running Protect 7.1.x. It documents siren, TTS, ringtone and volume calls, plus AAC-LC ADTS frame pacing for the AI Horn; Python examples implement the requests.

sr16-bridge reconstructs the SR16 smart ring's vendor BLE history-sync protocol in a local Python client. It reassembles segmented notifications, checks CRCs, decodes heart-rate records and imports HCI snoop traffic into SQLite; probe logs record the observed message behavior.

alpha1s reconstructs the UBTECH Alpha 1S robot's Bluetooth control link as a Python SDK for telemetry, servo movement and stored actions. Its protocol layer documents FB BF frame headers, length and checksum fields, RFCOMM channel 6, a 16-servo command and optional BLE transport, with examples and tests against captured frames.

Daybreak rebuilds COLMI R09 smart-ring communication in an offline Android client. Its Kotlin protocol module handles 16-byte commands and checksum validation, reassembles multi-packet sleep records, and processes heart-rate logs, steps and SpO2 data; the app computes local sleep, recovery and activity scores from the readings.

USB-Endoscope reconstructs the i4season Usee Plus endoscope’s vendor USB video protocol in a local WebUSB viewer. The author traced the Android app’s USBDEVFS calls with Frida and documented two stream-start control transfers followed by YUYV422 frames from bulk endpoint 0x82. The application displays live video and saves photos or recordings.

The Cigar Oasis Home Assistant integration reconstructs the SmartHumidor app’s cloud calls for humidity and temperature readings and setpoint control. The author captured app traffic with mitmproxy, documented the login and device endpoints, and implemented Python scripts and a Home Assistant package.

qss-switch-api reconstructs access to the private REST interface of a QNAP QSS-managed switch from its web UI JavaScript. Its Python CLI logs in, reads port, PoE, sensor and LLDP telemetry, and can send explicit API calls; the documentation records bearer-token authentication and response fields.

NameLand reconstructs serial printing for the Casio KL-A45 label printer from communication observed between the device and Casio's Windows XP software. Its Python program sends arbitrary text as QR codes through a USB-to-serial cable with a 2.5 mm TRS connection. The README describes the cable wiring and notes that other printer models may need code changes.

dh360d reconstructs the Darkflash DH360D cooler LCD's serial protocol from traffic captured between the hardware and its Windows Electron app. Its Python Linux driver sends CPU temperature, pump speed, CPU use and RAM use through a CH340 USB-to-UART link. The protocol notes specify the 115200-baud framing, handshake, status fields and device acknowledgments.

Sony WH-CH720N control is reconstructed as a Linux Python client for the headset's Bluetooth Classic RFCOMM service. The project documents its framed messages, checksum, ACK sequence rule and command map, then uses them for battery readings, six-band EQ and noise-cancelling or ambient-mode control.

The Kosmos CP1 toolchain reconstructs the CP2 cassette interface from a digitized real save and implements Python WAV encoding and decoding. Its documentation specifies FSK carriers, bit timing, byte order and the 256-cell memory image. An assembler and emulator support writing and tracing CP1 programs; the author reports a byte-exact encoding round trip.

pb40-bluetooth reconstructs the ISDT PB40/LIMETA EB40 power bank's BLE advertisement and GATT protocol from LiMeta app analysis and device captures. Its Home Assistant integration reads charge state without connecting, polls power and energy through GATT, and exposes a find-device command and reported settings.

Jacuzzi JB1HL Panel-Link Protocol documents the RS-485 messages between a Jacuzzi J185 hot tub's topside panel and I/O board. It identifies 38400 8N1 framing, a 34-byte poll-response burst, command bits and a checksum, then supplies an offline decoder and an ESPHome monitor for water temperature and pump or heater state.

The Tenx USB Missile Launcher controller implements movement and firing commands in PureBasic for a specific USB device. Its protocol reference documents two eight-byte headers and a 64-byte payload sent across two interfaces with a nonstandard control-transfer value.

Crypto Kakadu Alternative reconstructs the Crypto Kakadu password manager's serial database transfer and .kkd backup format from analysis of its Java manager and device behavior. Four PureBasic utilities read and upload device databases and convert between JSON and AES-encrypted .kkd files; protocol notes record commands, row layouts and encryption details.

alienware-m15-rgb implements Linux control of the Alienware m15 R2's per-key keyboard and chassis lighting through HID reports. Its protocol notes describe the Darfon API_V5 feature-report sequence and AW-ELC API_V4 output reports, including separate handling for the power-button light.

Ideal Clima Nemo 1000 local control replaces its Wi-Fi module with an ESP32-C3 on the CN2 connector and speaks the documented Tuya MCU UART exchange. The implementation exposes power, setpoint, mode and fan control through ESPHome or MQTT, with Python tools for passive frame decoding and bench commands.

Windows-Switch2-Pro-Controller reconstructs the Switch 2 Pro Controller's USB wake and HID report behavior in a Windows bridge. It parses button and stick reports, forwards input through ViGEmBus as an Xbox 360 pad, and relays rumble back to the controller; an optional BLE path is also described.

cyberboard-cli reconstructs the AngryMiao CyberBoard R4 configuration protocol used by AM Master. Its CLI reads keymaps and writes keymap and LED configuration through USB CDC serial frames, with protocol notes describing 64-byte framing and CRC-8. The author reports hardware-tested writes and keymap reads; per-key LED authoring remains unfinished.

gm1356-recordings implements a Python client for live readings and stored logs from the Benetech GM1356 sound level meter. Its protocol notes describe eight-byte USB-HID reports, the 0xB5 import handshake, 0xC4 pull loop and packed recording samples. The author reports comparing decoded recordings with data on the device.

TwoTrees SK1 display research documents the printer's HMI UART commands and incoming touch, numeric and startup frames. The repository uses that mapping in a Rust client connected to Moonraker, a Python demonstration host and an experimental ESP32-C6 display client.

KW330 OBD Data Access reconstructs how the KONNWEI KW330 handheld scanner exposes live OBD data through its USB CDC serial port. Python scripts find the port, capture the Print Data Stream output, and parse its Latin-1 label-and-value lines into time-series JSON keyed by engine-running time.

AstralPool Halo Cloud reconstructs cloud control of Halo chlorinators as a Home Assistant integration. BLE onboarding retrieves device-generated credentials, after which a client uses the vendor WebSocket relay and parsed device messages for telemetry and control. The security notes document authentication values extracted from the official app binary.

zen-go-tui reconstructs control of the Antelope Zen Go Synergy Core audio interface through its USB HID protocol. The Rust terminal app manages outputs, mixer strips, preamp settings and meters, while protocol notes describe captured frame types, command payloads and state fields.

tinyscreen implements a Linux client for ArtInChip USB bar displays using a reconstructed device protocol. It performs the display's two-phase RSA challenge-response exchange and sends JPEG frames with 20-byte headers over USB bulk transfers. The client can present dashboards, video, web pages or an EVDI virtual monitor.

Panavox PSS-12 INV reconstructs control of a split air conditioner through its W950 UART connector. The C++ library builds command frames, handles acknowledgments and periodic status requests, and parses 150-byte status responses; a companion specification records frame layout and commands refined through physical-unit testing.

The WB-SG1-8G project documents the BG7TBL signal generator's serial protocol and implements a browser controller over Web Serial. Its protocol notes specify connection settings, $X...* command framing, frequency and sweep commands, hardware toggles and observed replies. The page controls both output channels and monitors received and transmitted traffic.

The Brother HL-4150CDN driver reconstructs the proprietary XL2HB print stream produced by Brother's 32-bit x86 filter. Its Python and optional Cython implementation handles raster encoding, color processing, PJL job settings and CUPS integration, with comparison fixtures for byte-level output matching.

monclub-bot reconstructs MonClub app booking exchanges from intercepted HTTPS traffic. Its research notes document two-step authentication, request identifiers and endpoints for listing sessions, booking and cancellation. A Rust CLI and Discord bot use the recovered exchanges to manage reservations and export upcoming sessions.

glow-linux reconstructs the Spacetronik Glow Three 27V LED controller's USB serial exchange from captured traffic. It documents the CH340 initialization sequence and AA 55 framed handshake, color and heartbeat messages, then uses pyusb for Linux lighting control and PipeWire screen capture for ambient color sync.

nanparty reconstructs Nanlite PavoTube II 6C control over BLE mesh and bridges MIDI controls to light settings. Its Python code provisions the light, builds mesh messages and drives hue, saturation, brightness and effects; the protocol reference maps GATT characteristics, authentication and vendor PDUs.

m3508i reconstructs the M3508I motor’s half-duplex RS485 command and reply format. The repository documents field offsets, motor selection, speed encoding and CRC16, and supplies a C frame builder and parser, an STM32 example and an adapter-board design.

KeyMission 360 Tools documents and implements USB PTP control of the Nikon KeyMission 360, including the FormatStore command for its SD card. Its protocol research records USB endpoints, PTP container layouts and command responses. The Linux toolkit also provides camera information, downloads, time sync and media controls.

Evnia reconstructs USB control of the Philips Evnia 49M2C8900 monitor's 44 Ambiglow LEDs in a macOS Swift library. Its protocol notes identify vendor-specific endpoint-zero requests, the 0xE100 RGB frame buffer, and control blocks for taking and releasing software ownership.

audeze-filter-cli reconstructs the Audeze Filter USB speaker's settings interface as a Python CLI. Research notes trace command bytes and value conversions through the AudezeHub Mach-O binary, while the protocol reference describes HID report IDs, packet headers and read/write operations.

casio_fx implements Linux serial transfers for Casio calculators and documents their section-based message exchange and CAS file structure. Its send and receive utilities handle program data for fx-7700GB and fx-7700GE; a converter turns supported monochrome CAS screen dumps into PBM images.

Falmec Nuvola 90 remote research reconstructs the range hood's 433 MHz OOK control messages from captured signals. The documented 33-bit frame encodes fan speed and light state using 320 and 640 µs pulses; Python receiver tools decode captures, while Raspberry Pi and ATtiny85 transmitters send replacement commands.

HeronSquawk reconstructs the RYLR999 LoRa module's on-air framing from SDR captures so it can exchange packets with Heltec V3.1 SX1262 nodes. The resulting mesh system combines a Python desktop base station, MicroPython node firmware and an Android BLE client, with encrypted messages routed across nodes.

TP-Link SG3428 USB Reset reconstructs access to a JetStream switch's USB console through a Python raw-USB client. The investigation found that a vendor-class interface responds to CDC ACM line-coding requests; the tool sets 38400/8N1, exchanges data over bulk endpoints and exposes an interactive console, baud scan and BootUtil reset workflow.

ak820-linux reconstructs USB HID control for the AJAZZ AK820 Pro keyboard from the vendor's Windows configurator. Its Linux CLI and GUI send lighting effects, per-key colors, images or GIFs to the keyboard screen, and clock updates; the protocol reference records interfaces, report sizes, opcodes, and payload layouts.

LUMIX Remote reconstructs Panasonic LUMIX camera control in a Python server, web interface and CLI. For the DC-S5, its notes map cam.cgi commands, UPnP services, UDP live view and Bluetooth LE connection sequences; the client supports shooting, settings, file import and timelapse operation.

fix-whxm4-voice creates replacement voice packs for Sony WH-1000XM4 headphones and uploads them over Bluetooth. Its research notes map the pack's language layout and trace Sony's app through the Airoha FOTA upload flow over Bluetooth Classic RFCOMM. The tool can download stock packs, convert replacement audio and install the result as a selected language.

OrangeCar reconstructs the phone side of wired Apple CarPlay on an Orange Pi 5 Plus so a car displays a locally rendered dashboard. Its protocol documentation follows USB role switching, iAP2 identification, CDC-NCM networking, mDNS and the AirPlay session that carries H.264 video, audio and input.

AirDrop-for-Everything reimplements Apple's AirDrop discovery and file transfer in a Rust core with command-line, desktop, Android and macOS interfaces. The documented protocol covers mDNS discovery, binary-plist /Discover and /Ask requests, and DVZip-framed cpio uploads. AWDL works where an interface exists; other platforms use LAN transport.

IQOS Bar implements read-only USB HID access to an IQOS ILUMA i ONE, displaying battery status and lifetime usage counters in a desktop tray or menu bar. Its protocol notes describe report framing, register queries and hidapi response offsets, adapting the command layer credited to iqos-scope.

Chorus identifies and backs up Logitech Harmony USB remotes, learns and decodes IR codes, and controls hubs over a local network. Its browser editor creates JSON device and activity configurations; technical notes document the vendor setup app and newer USB packet protocol.

tinycoral reconstructs the Google Coral Edge TPU instruction set and USB runtime for a tinygrad backend. It includes decoded instruction layouts, a code generator, DarwiNN executable handling and a Python driver for firmware upload, register access and DMA transfers; the author reports byte-identical generated programs against Google's compiler for supported operations.

ninebot-go reconstructs the Ninebot app's encrypted cloud communication in a Go client. It implements NET request encryption and response decryption using AES and RSA, then exposes vehicle, battery and travel data through CLI, web and MCP interfaces; vehicle-control commands remain unfinished.

open-g2-hub replaces the Even Realities G2 companion app with a local hub for native widgets and voice input on stock firmware. Its protocol notes describe dual-lens BLE characteristics, an AA 21 control frame, CRC-16 checksums, service IDs, heartbeats and LC3 microphone data.

Edifier Speakers BLE reconstructs the M60 and M90 speakers' BLE control protocols and uses them in a Home Assistant integration. Its references describe model-specific GATT services, frame checksums, commands, responses, and limits; the integration exposes volume, source, EQ, playback, and selected device settings.

Halyard reimplements the Shadow cloud PC streaming protocol for Nintendo Switch and PS Vita homebrew. It authenticates to a subscribed user's machine, negotiates over TLS, and carries encrypted video, audio, input and cursor channels; the consoles use hardware video decoding. The repository records protocol findings and platform-specific limits.

Axial documents and implements Bluetooth control of the DJI RS 4 Mini gimbal. Its Mac GimbalProfiler observes messages and tests commands, while an iPhone app uses a model-specific .axial profile and shared DUML framing to send controls and decode signals.

The Fiat Ducato X250 WiCAN project decodes the 2009 vehicle's 50 kbit/s body-CAN messages into speed, RPM, lights, doors and other signals. It preserves five captures, a CAN ID reference, a Python decoder and listen-only WiCAN filters that publish values to Home Assistant over MQTT. The author reports checking signals against vehicle controls and instruments.

Unrack controls the t.racks DSP 4x4 Mini Pro through WebHID, an Android USB bridge, or an ESP32-S3 Wi-Fi bridge. It builds on earlier protocol research and provides rebuilt transport, state management, and interface code; its protocol notes detail request and reply frames carried in 64-byte USB HID reports, commands, and parameter scaling.

ArmorX Toolkit reconstructs configuration and control behavior for the BIGBIG WON ARMORX Pro controller accessory. It decodes and builds 144-byte configuration records with CRC16, records key mappings and BLE/USB command behavior, and supplies capture, CLI, and configurator tools based on the findings.

dsh-ls125-uv-probe reconstructs the UART exchange between a LinShang LS125 meter and its UVALED-X3 UV probe and implements a replacement STM32F103 host. Its protocol notes cover 9600 8N1 framing, polling and clear commands, measurement fields and CRC-16/MODBUS. Capture and decoding scripts and a sample trace accompany the agent skill.

HT-203U Linux tools reconstruct video and temperature capture for the HT-203U USB thermal camera. Protocol notes document its UVC frame layout, USB control sequence and calibrated mode 8 temperature encoding; the supplied scripts display live video, read summaries and save per-pixel temperature frames.

Pair-Raught implements an nRF52840 controller bridge that receives Steam Controller input over Valve's RF link and presents a Pro Controller over USB to Nintendo Switch 2. Its firmware also sends a BLE console wake, forwards motion and rumble, and stores pairing and settings on the puck.

SPORTident SRR reconstructs the 2.4 GHz radio exchange used by SIAC cards and BSF8-SRR stations to send punches. Its documentation maps CC2500 settings, packet fields, acknowledgements and timing, while an ESP32/CC2500 sketch receives and acknowledges frames and a Python tool decodes captures.

Tapo V4 reconstructs the Tapo C510W camera’s local control and media protocols from Android app analysis and device probing. A byte-level specification and Python client cover SPAKE2+ login, AES-128-CCM /ds requests, media-port authentication and SD-card clip download. The author reports operation on a C510W and limited reports from other models.

Omni Tray reconstructs USB HID control of the SteelSeries Arctis Nova Pro Omni GameHub in a Windows tray client. Its protocol notes map report collections, command transfers and event channels; the client exposes battery, mute, ANC and volume state and can relay telemetry through MQTT.

tapo-local implements local control of the TP-Link Tapo P110 smart plug using TPAP communication recovered from the Tapo Android app. Python clients provision the plug over BLE, then use Wi-Fi sessions with SPAKE2+ and AES-128-CCM for relay control, power readings and automation.

castty reconstructs configuration of the Mionix Castor mouse on Linux from captured HID feature reports. Its protocol notes describe command report 0x60, profile report 0x61, readback, and field offsets; the Rust GUI and CLI use those findings for lighting, DPI, buttons, macros, and profiles.

legion-gpu-rgb reconstructs RGB lighting control for a Lenovo OEM RTX 5070 Ti by tracing its DDC-side NvAPI I2C transactions. It documents the controller's register writes and supplies a Python controller, an OpenRGB plugin and a patch that exposes the DDC bus to OpenRGB.

SoundcoreBridge reconstructs Soundcore Space 2 headphone controls over the vendor Bluetooth channel for a macOS menu-bar app and CLI. Its protocol map documents command addressing, state offsets, noise-cancelling modes and equalizer values from observed traffic and device responses.

NiimBridge reconstructs the NIIMBOT D110_M printer's Bluetooth print exchange from HCI captures of the vendor Android app. Its Kotlin driver implements packet framing, checksums, row encoding, transport, and print-state handling; a separate SDK and diagnostic app expose printing and packet inspection. The author reports byte-identical packet comparisons for two captured jobs.

The OMS fingerprint module investigation reconstructs USB communication with the 33a7:2388 match-on-chip sensor and implements it as a libfprint driver. Its notes describe USBC transport acknowledgements, EF01 frames, checksums and enrollment and identification responses; the author reports successful hardware enrollment and verification.

zwift-api maps selected private Zwift HTTP data interfaces and implements a read-only Node client for profile, achievements, events, quests and catalogue data. Its documentation records proxy-captured endpoints and protobuf wire decoding without schemas. The author reports that epic-challenge progress travels over a realtime UDP path rather than the mapped HTTP endpoints.

Gear VR Controller research decodes the Samsung ET-YO324 remote's Bluetooth LE commands and sensor stream. Its protocol notes map GATT characteristics, a command acknowledgement handshake, IMU samples, touchpad and button fields; Python captures and tests support a macOS air-mouse app and a live three.js viewer.

Acer Predator Helios 16 RGB documents lighting exchanges for PH16-series laptops and implements Linux control through a Python CLI and OpenRGB controllers. It maps the keyboard's vendor HID reports and the standard HID LampArray interfaces used by the front bar, lid logo, and rear glass bar.

Powerology AM8268N reconstructs the USB display protocol used by dual-screen laptop extenders built around the Actions Micro AM8268N. A Linux userspace driver presents each panel through evdi and sends JSON-RPC control and H.264 video over vendor-defined HID interfaces; the protocol notes derive from captures of the Windows application.

SuperCam Thermal Viewer is a cross-platform client for QuanLi/LangChi thermal cameras built from investigation of their proprietary network traffic. It displays 160×120 radiometric infrared frames alongside 1920×1080 H.264 video, while research notes document UDP discovery, TCP control and stream negotiation.

ktctl reconstructs the FiiO JA11 runtime USB control protocol in a Rust CLI and TUI for five-band PEQ, presets and gain. Its protocol notes specify framing, CRC-8/MAXIM and command bytes derived from Android app analysis and device probing. The author reports a successful read, write and save round trip on a JA11.

The AppleAVE2 investigation maps the kernel driver's IOKit user-client selectors and input structures while examining the work-buffer size calculation associated with CVE-2026-64747. It includes a userspace reachability program, wire-format notes, overflow arithmetic and patched-host logs. The author reports that a hardware capability gate prevented a live overflow on that host.

Indian Thunder Stroke documents a listen-only J1939 CAN decoder for a 2017 Indian Springfield motorcycle, with ESP32-S3 firmware and an Android instrument cluster. Its findings map messages for tyre pressure and temperature, fault codes, controls and engine state, including measured PGN and byte positions; the hardware publishes decoded values over BLE.

Smart Ring Dashboard implements direct Web Bluetooth access to Anko/Jring and Colmi/Yawell smart rings using documented BLE packet formats. Its protocol reference describes GATT services, commands and response layouts, while the browser app displays heart rate, activity, sleep and oxygen readings.

Thermal Cam implements a macOS viewer for the Thermal Master P1 using a documented USB control and frame protocol. Its Swift driver starts the vendor stream through libusb, decodes radiometric frames into temperatures, and displays palettes, per-pixel readings, and snapshots.

controlvault3-linux-fingerprint reconstructs the encrypted command exchange of the Dell/Broadcom ControlVault 3 fingerprint sensor and implements enrollment and verification on Linux. It offers a libfprint TOD driver for fprintd and an alternative standalone PAM path. The author describes deriving the channel from Windows USB captures and crypto hooks and reports testing on a Dell Latitude 5531.

glorouter reconstructs the Huawei B311-221 router's HiLink web API in a Python CLI and local dashboard. Its protocol notes trace endpoints from served JavaScript and browser captures, including SCRAM-SHA256 login and CSRF token handling; the client exposes signal, traffic, network, SMS and USSD controls.

OpticFilm 135i reconstructs USB control of the Plustek OpticFilm 135i film scanner for Linux. Its Python driver handles calibration, film movement and 16-bit image capture at five resolutions, while a separate SANE backend exposes scanning to standard frontends; research notes record protocol and calibration findings.

The Martian Notifier toolkit reconstructs Bluetooth communication with the T200/MN200 smartwatch. Its protocol notes specify RFCOMM framing, BLE GATT identifiers and command opcodes for battery queries, time and date updates and keepalive. Python tools pair with the watch, send commands and probe additional opcodes from Linux.

E88 / E99 Drone PC Control reconstructs the Wi-Fi control and video exchanges of an E99-labeled toy drone with an E88D board and FlyUFO app. Its Python client sends documented UDP stick and heartbeat packets, receives telemetry and presents an RTSP-derived MJPEG stream in a browser.

Samsung Washer Monitor for ESPHome decodes the receive-only UART stream between a Samsung WW11BGA046 washer's DC92-01950B panel and main board. Its ESPHome component exposes program selections, displayed time, indicators and inferred cycle status to Home Assistant. The documentation records connector observations, wiring and the limits of the author's single-machine testing.

Fluval Connect light implements local Home Assistant control of Fluval Connect aquarium lights over Bluetooth, using commands recovered from the FluvalConnect Android app. It exposes lighting, modes, schedules and clock synchronization, with support confirmed by the author on a Roma & Shaker 2.0 light.

Citroën Connected Camera is an iOS client for browsing, downloading and managing ConnectedCAM dashcam recordings over local Wi-Fi. Its protocol reference reconstructs the camera's cleartext HTTP /virb command endpoint, media access and session handshake from traffic captured from the official app.

The Canon GM2080 macOS driver reconstructs the printer's IVEC XML and PWG Raster print stream from observed output of Canon's Linux driver. Native CUPS filters generate that stream for a GM2080, with PPDs for related GM series models. The author reports end-to-end printing on a GM2080 running firmware 1.050.

Agent Phone uses a Polycom CX300 desk phone as an attention and dictation controller for coding agents. Its HID documentation preserves earlier protocol research and adds device-probe findings on report byte layouts, the voicemail LED, and host-controlled microphone mute. The Python daemon implements those controls alongside the phone’s audio and keypad handling.

RingLink reconstructs direct access to RingConn Gen 3 smart rings in an offline Android client. It uses a documented BLE framing and SM3 authentication exchange to sync history and live readings into SQLite, then exports supported health records to Health Connect; it also sends vibration commands for calls and notifications.

GarminHRM600 implements a direct BLE client for the Garmin HRM 600 heart-rate strap using documented Multi-Link, GFDI and protobuf FileSyncService exchanges. Its CLI streams heart rate and Running Dynamics, downloads stored FIT files and reconstructs absolute timestamps from the strap's event clock and file identifiers. A protocol reference records message layouts and the author's probe results.

Canon IVEC driver reconstructs print and maintenance commands for PIXMA and MAXIFY inkjets in an open Linux CUPS driver. Its protocol reference documents IVEC XML job framing, PWG Raster page data and USB status handling. The author reports byte-for-byte matches against Canon driver output for 1,194 checked jobs and commands.

Minitela do Positivo Vision R15M implements Linux tools for the laptop’s 240×240 secondary display. The project documents its AHMI serial frames and ACF texture container using vendor-app captures, synthetic-image output comparisons, and analysis of the Windows texture compiler. Python tools send images, change pages and brightness, update display tags, and inspect the protocol.

Truma Aventa controls a second-generation Aventa roof air conditioner from Home Assistant over BLE. The implementation uses captured TruMessageV3 and CBOR messages to expose climate, light, and diagnostic entities. Its findings document BLE framing, device addresses, routing, and pairing behavior observed on the appliance, including corrections to a prior protocol reference.

PetKit Eversweet Max 2 UVC BLE Gateway uses a local Python or ESP32-C3 client in place of the Wi-Fi PetKit device that relays the fountain’s data. It reads state and drinking history and sends Telegram alerts. Its protocol notes document BLE framing, authentication, a 42-byte state map and history flow control derived from device observations.

WalleCube UPS provides local Home Assistant monitoring and control for the W150 mini-UPS through a reconstructed BLE GATT protocol. The author used Android app strings, Frida captures, and Dart disassembly to map telemetry and encrypted settings; PROTOCOL.md records the wire format. The integration exposes power and battery readings and selected settings, with writes checked by reading them back.

toppingctl implements local control of Topping DACs through USB HID reports derived from observed WebHID traffic and the vendor web bundle. The CLI addresses registers for volume, gain, power and parametric EQ, while companion scripts read settings, inspect unsolicited meter data and probe unknown values. The author reports hardware confirmation on the DX5 II.

tuya-ipc-p2p-sdk implements a Python client for Tuya IPC cameras’ native P2P video protocol. It logs in through the mobile gateway, exchanges MQTT signaling, connects through a TCP relay with KCP conversations, authenticates a media channel, and decrypts and reassembles MJPEG frames. The implementation draws on a byte-level protocol reference in the author’s companion Go client.

The SYNA8002 investigation reconstructs the SPI transport, secure-channel setup and image capture path of the fingerprint reader in a ThinkPad X1 Tablet Gen 3. It includes a Python userspace driver and fprintd-compatible adapter; the author reports successful GDM login on one tablet, with a correlation matcher and an existing Windows-derived pairing key.

fx_lcd_software drives ID-COOLING FX cooler LCDs from Linux through a USB HID image-transfer protocol observed from the vendor software. It converts images to 240×240 baseline JPEG and sends framed data in paced 1024-byte chunks, with rotation options.

ti83-link reconstructs TI-83 Plus link-port transfers using Raspberry Pi GPIO and Python. It sends and receives calculator variables, installs Flash applications, inspects TI file containers and documents packet handshakes and token values checked against hardware.

catbus99 reconstructs control of the Epomaker TH99 Pro keyboard display from captured driver WebHID traffic. Its Rust client sends USB-HID reports to display images and rendered widgets, while a protocol document maps the configuration and TFT interfaces. A daemon governs writes to the display's flash storage.

OpenWatch implements an Android companion for LJ736/LY736D-based smartwatches using BLE commands reconstructed from the LaxaFit Pro APK and captured traffic. It handles pairing, notifications and clock synchronization locally, and can buzz the watch to help locate it. Protocol notes describe packet framing and watch-face transfer; the author reports that custom watch faces still display as blank black screens.

Quntis Monitor Light for ESPHome recreates local control of a 26-inch Quntis monitor light through its observed XN297-compatible RF protocol. An ESP32-C3 and RF Nano transmit commands for power, brightness, color temperature and the separate glow light; protocol notes describe frames, CRC and rolling state.

Bosch Smart System maps the BLE diagnostic and Live Data interfaces of Bosch eBikes through captured traffic and field comparisons. It documents characteristics 0x0011 and eb21, frame structure, telemetry scaling and request behavior, with machine-readable field tables. The principal observations come from a Performance Line CX bike; comparison with a Performance Line SX is preliminary.

GreenPods is an Android app that reads AirPods BLE advertisements and offers Apple Accessory Protocol controls over L2CAP where available. Its protocol research records packet structures, transport requirements and captured device behavior for battery status, noise control, gestures and head tracking. The app exposes features according to the available Android Bluetooth path.

dualsense-bridge recovers microphone audio carried inside DualSense Bluetooth HID reports and exposes it as a macOS audio input. Its research note documents the extended-report switch and microphone-enable output report; the application also maps controller input to desktop controls.

FX30 Controller implements remote control of the Sony FX30 camera on an M5Stack Cardputer ADV. It joins the camera's Wi-Fi Direct network, performs PTP-IP and Sony SDIO handshakes, and uses documented property and control codes for recording, exposure adjustments and status. It also provides live view.

P215 Scan replaces the Canon imageFORMULA P-215II desktop scanning workflow on macOS and documents the scanner’s file-tunnel transport. Its reconstructed Auto Start mode exchanges SCSI command and data blocks through two files on an emulated USB volume; the main scanning mode uses the SANE canon_dr backend.

Sirius Dev Kit documents a measured investigation of the Hengbot Sirius robot dog and provides a browser control tool. Its findings map command behavior, ROS topics, sensor readings, and the robot’s RIFF/AVI action-file structure. Firmware comparisons identify changes to the ToF sensor path, while the tool uses the documented interfaces for robot control.

Narwal Robot Vacuum is a Home Assistant integration built around the vacuums' local WebSocket interface. It includes helpers to capture phone-to-robot traffic, decode protobuf frames from packet captures and probe commands, alongside cleaning, station and map controls.

landbook-api reconstructs Landbook smart-home client access in Python from analysis of its iOS app. It handles REST login and device queries, MQTT state and control messages over WebSocket/TLS, and direct TCP control on a local network.

SF900 ESP32 Dongle implements the SF900/SF2000 controller's 2.4 GHz XN297L radio protocol on an ESP32-S3 receiver. It presents controller input as USB HID or BLE HID and includes a separate USB Wi-Fi mode.

hydroshift2 reconstructs direct USB control of the Lian Li HydroShift II LCD-C in a Rust library. It documents a DES-CBC command envelope and commands for JPEG and PNG display layers, brightness, rotation, pump and fan control, and TinyUZ-compressed RGB animations.

N2Elite-ng reconstructs control of the N2 Elite / Amiiqo USB dongle in a Python CLI and Tkinter GUI. Its protocol reference describes the CP2102 serial bridge to an MFRC522 NFC frontend, while the client reads NTAG215 tags and manages banks on an unlocked N2 disc.

Huawei MateBook 13 · Linux reconstructs communication with the Goodix GXFP51A0 fingerprint reader and provides a Linux libfprint driver for it. Its research notes describe SPI packet framing, acknowledgement and response handling, and static analysis of Goodix FP Windows driver versions; the repository also manages MX250 power on the target laptop.

TP2-Y Label Studio implements direct label printing to the TP2-Y thermal printer over Bluetooth Classic RFCOMM. Its protocol notes describe captured frame structure and print-job commands; the Windows Python client provides a local web designer and command-line printing.

Halo Home for Home Assistant controls Eaton HALO Home Bluetooth mesh lights locally and targets other Avi-on lights using the same protocol. Its CSRmesh protocol document describes GATT characteristics, encrypted packet delivery and passphrase-based key derivation for on/off, brightness and color-temperature controls.

foobot-local reconstructs Foobot communication so the air-quality monitor can send readings to a local service. It documents MQTT topics, a UDP AT configuration channel and Wi-Fi provisioning recovered from the official APK; the Python service decodes readings and computes a pollution index.

noirm1 reconstructs the NOIR M1 mouse's wired USB HID settings protocol from disassembly of the vendor's Windows utility and device checks. The Rust CLI writes polling rate, DPI and lighting settings through hidraw; protocol notes record packets and EEPROM fields.

PetMarvel C1 Local reconstructs the litter box's cloud-facing TLS and MQTT exchanges in a router-hosted Go broker. Protocol notes describe topics, TLV commands and status fields; Home Assistant patches connect to the local broker.

omen-lcd reconstructs the USB HID control exchange for the HP OMEN AIO cooler's LCD and implements a Linux driver. Its protocol notes describe identification, 480×480 JPEG frames and brightness messages captured from OMEN Gaming Hub.

QCY Control for macOS implements a Swift menu-bar client for QCY MeloBuds Pro using the documented QCY BLE GATT protocol. It controls noise modes, EQ, gaming mode and touch mappings, and lists UUIDs and example command frames.

BTHackers documents the AIREC voice recorder’s BLE GATT service and command protocol from captured sessions. Its protocol reference maps characteristic handles and the 55 aa command and aa 55 response frames. The repository includes capture parsers, a Python client, and a Flutter app; the author lists connection fixes and the file-download command as open work.

MacBook ALS maps the 122-byte HID report of an Apple Silicon MacBook ambient-light sensor. Python scripts read five raw channels, lux and color temperature, while recorded CSV runs and colored-light tests support the reported field positions and channel responses.

The SteelSeries Apex 3 RGB Controller uses recovered USB HID reports to set the keyboard’s lighting colors from Linux. Its technical notes identify the device interface, a 32-byte report, color opcode 0x0B, and RGB values for ten zones. The repository includes a command-line program for sending color settings.

rfserver implements Raspberry Pi Pico W firmware for controlling LED lights through a decoded 433 MHz remote signal. It sends commands over RF, tracks changes made by the physical remote and exposes HTTP endpoints for commands and state.

ro is a Rust command-line client for controlling the LB-Link BL-WR2000 repeater through its HTTP interface. It sends login and goform requests to scan for Wi-Fi networks, connect to a network, read status, reboot and reset the repeater.

dvf3060 implements control of the Kenwood DVF-3060 DVD player's front panel through its PT6311 SPI controller. A TM4C123G driver displays characters and icons and polls key states; the source separates hardware access, controller commands and display logic.

galaxy-buds-plus implements a Perl client for Samsung Galaxy Buds Plus settings through the headset's RFCOMM serial interface. The author developed it by probing the undocumented device protocol on Linux; some messages and options remain undecoded.

DT No.1 F2 reconstructs the Bluetooth LE exchange between the smartwatch and its Android companion. The project documents GATT handles, message framing and commands, and implements a Python framework and replacement Android app.

The Maia Ds2 investigation documents Bluetooth serial commands for controlling the amplifier. A command list and Python example show how to connect and send a channel-selection message.

fifine-ampligame-d6 reconstructs USB control of the Fifine AmpliGame D6 macro pad in a Python macOS driver. Its documentation describes vendor library disassembly, report formats, display wake behavior and LCD slot mapping; the code also bridges the device to Bitfocus Companion Satellite.

PS5 pela rede provides a Node command-line client for checking whether a PS5 is on or resting and for waking or resting it over a home network. It implements DDP discovery on UDP port 9302 and WAKEUP from documented packet behavior, while registration and rest commands use playactor.

BudsCtl reconstructs SoundPEATS Air4 Pro GAIA V2 controls for a macOS menu bar app that changes noise mode and reads each earbud's battery level. Its documentation identifies the BLE service, command framing, and response behavior; a separate Samsung RFCOMM implementation draws on a cited protocol reference.

A Linux ALSA driver reconstructs the RME Babyface Pro FS proprietary USB mode from Windows captures. It handles interrupt-endpoint PCM streaming, mixer controls and front-panel input, with protocol and calibration notes plus USB capture-analysis tools.

wolfmix-automation reconstructs the Wolfmix W1 .wpj project format and USB control protocol from controlled editor changes, owned project files, and device observations. It publishes a byte-level specification and Python tools to inspect, diff, round-trip, compile, and generate project files, plus a USB client.

This study reconstructs the receive side of the LoRa link from a Mammotion RTK 3 station to a Luba mini AWD 800H mower. It documents frequency hopping and an RTCM3 container, with SX1276 receiver firmware and Python tools that analyse captures and extract corrections.

DingTalk A1 Local Toolkit reconstructs the recorder's BLE authentication and recording-transfer exchange for local access from Windows or Linux. Its Python tools read device status and recording indexes, download recordings, and convert BABA/DTYJ Opus containers to Ogg/Opus.

Remote for Apple TV implements Apple TV control on Android through Kotlin modules for Companion Link pairing, encrypted OPACK commands, and an MRP-over-AirPlay media tunnel. Its protocol module and desktop CLI cover discovery, remote keys, text entry, and now-playing data; the project credits pyatv for protocol values and reference vectors.

panelbeater lets a Linux host respond to the Scan button on a ScanSnap iX1500 over Wi-Fi or USB. Over Wi-Fi it registers the host with the scanner; over USB it scans without registration. Its protocol notes document discovery, registration, document transfer and USB behavior, while the client assembles scanned pages into PDFs and can add an OCR text layer when ocrmypdf is installed.

VT-Ragnaros implements a Linux driver and daemon for the Redragon SS552 Ragnaros USB control deck. It reconstructs commands and input reports from the vendor's SDLibrary1.dll, sending JPEG frames in 1024-byte USB packets and decoding key, knob, and touch-strip events for configurable profiles.

A Flipper Zero signal set and Python generator reproduce PixMob Wave2 and Waveband 2 group-0 RF commands for European 868.415 MHz wristbands. Protocol notes describe OOK timing, 6b/8b field encoding, CRC-12, wake frames and persistent color or OFF packets.

The Goodix 55a4 project reconstructs Linux support for the 27c6:55a4 fingerprint sensor through a libfprint patch. Its research combines USB captures with examination of the vendor's Windows driver to document command behavior, image acquisition and host-side matching. Installation scripts provision the sensor key and configure fprintd.

allmiibo-sync reconstructs the Pixl.js and AmiiboLink Bluetooth LE virtual filesystem protocol to synchronize folders with NFC emulator devices. Its browser app compares local and device trees, plans transfers and deletions, and uses VFS commands documented from official web clients and checked against firmware.

EBO for Home Assistant reconstructs the EBO HOME cloud exchange to control Enabot robots from Home Assistant. Its add-on logs in with the user's account, discovers robots, sends commands through Agora RTM and converts Agora RTC video to an RTSP camera feed. The repository includes request-signing and message-routing tests.

iM.Master SDK reconstructs the iM.Master toy robot's BLE advertising commands and exposes them through a Python control API. Its protocol notes describe a 14-byte manufacturer payload under company ID 0x53A6, recovered from vendor-app captures, while the driver streams frames through Linux raw HCI to move the robot.

A protocol reference and Python decoder reconstruct the baseband infrared register broadcast of SymCom and Littelfuse PumpSaver Plus pump-protection relays. It maps 32-bit words to voltage, current, power, settings, counters and fault history, with sample captures and decoder tests.

Mazda MX-5 ND3 OBD-II PID Research maps diagnostic responses from a 2025 MX-5 RF Club. It records Mode 01 and manufacturer-specific Mode 22 PIDs, decoding formulas, observed values and range-scan results gathered through an OBDLink MX+ adapter.

QUII Helper reconstructs communication with QUII and Qualvision video intercoms in a Python client for snapshots, video, RTSP forwarding, device inspection, and door commands. Its protocol notes map LAN TCP setup, encrypted play, media handling, and cloud preview flow to behavior found in inspected app builds.

KlipschRemote implements Bluetooth LE control of Klipsch The Fives, Sevens and Nines speakers through desktop, CLI, Python and browser clients. Its protocol documentation describes the shared GATT control service and an investigation of the Fives Updater Android app that maps a separate GAIA/RFCOMM firmware-update exchange. The client controls volume, inputs, equalization and device settings.

AirMini Sync reconstructs the ResMed AirMini telemetry exchange in an Android client that retrieves and exports sleep records as JSON. Its protocol reference describes Bluetooth Classic RFCOMM transport, a Diffie-Hellman pairing exchange, encrypted JSON-RPC requests and notifications, and therapy log streams.

OpenNord reconstructs Nord Stage program handling and USB transfer in a keyboard companion app. It reads Stage 2, 3 and 4 program files through a shared CBIN container and model codecs, and uses a recovered vendor bulk USB protocol to enumerate devices and transfer programs. Sample readers and a local library support inspection and playback.

OpenStrap research reconstructs WHOOP 4.0 BLE framing, history synchronization and sensor-record decoding. Its Python research client can scan and connect to a band, stream heart rate and motion, drain history, decode frames and replay saved captures.

fpdrv reconstructs communication with the Synaptics 06cb:00e7 fingerprint sensor as a Linux userspace driver, libfprint TOD module and diagnostic CLI. It implements host pairing and a TLS-like encrypted session for on-chip enrollment and matching. Its protocol notes map USB endpoints and captured connection flows.

PixyPilot implements Linux control of the EMEET PIXY camera using V4L2 ioctls and decoded vendor HID commands. Its research documents HID report layouts, captured commands, and UVC extension-unit investigation, while the app provides PTZ controls, preview, recording, and capture import.

Prismatic reconstructs the SteelSeries Arena 7 speaker lighting exchange in a macOS menu bar app. It sends USB HID output report 0x06 with commands and RGB values for four zones, using a layout recovered from SteelSeries GG USBPcap traffic. The app controls left and right colors, brightness and power.

A Linux Python CLI uses the reconstructed HID++ HITS feature of the Logitech G PRO X2 SUPERSTRIKE mouse to read and set per-button click haptics and actuation points. Protocol notes derive feature 0x1B0C and its report fields from G HUB USB captures and device probing.

AT2 HT implements the Baofeng ALERVITES AT2 radio's BLE control and off-network messaging in an Android app. It supports channel programming, messages and PTT, and replaces voice encoding with OpenCORE-AMR MR475 and image processing with a Go implementation compared against the original library.

Empatica E4 wristband work reconstructs the device's BLE telemetry flow and provides a local recorder and decoder for accelerometer, skin temperature, electrodermal activity, and raw photoplethysmogram data. It documents GATT services and packet layouts, preserves raw packets, and writes decoded sensor readings to CSV.

Polylux implements Windows control of ASUS ROG AniMe Matrix, LiveDash OLED, Ryujin LCD, Aura RGB, and fan hardware. It documents USB protocols decoded from Armoury Crate captures and combines direct device drivers with OpenRGB and LibreHardwareMonitor interfaces.

AK820 Pro Modder implements macOS control of the Epomaker and Ajazz AK820 Pro keyboard through a Rust HID protocol library shared by a Tauri app and CLI. Its protocol notes distinguish two firmware families and document commands for lighting, keymaps, macros, the TFT display, and device settings.

dj-midi-sender reconstructs the Pioneer Pro DJ Link tempo exchange and bridges it to MIDI clock. A shared C++ parser and state machine read beat and status packets, track the tempo master and drive a 24 PPQN clock on desktop or ESP32-S3 hardware. The repository includes packet captures, protocol offsets and replay tools.

A protocol study and Python client reconstruct the OxyII Bluetooth LE link used by the Wellue O2Ring-S T8520 pulse oximeter. It documents GATT characteristics, framing, CRC-8 and commands for device information, live SpO2 and heart rate, and stored-file transfer.

Blackmacro-lib reconstructs the Blackmagic Speed Editor USB HID exchange in reference MicroPython firmware. It documents report sequences and authentication research, enabling a HID-capable microcontroller to present Speed Editor controls to DaVinci Resolve.

libfprint Goodix SPI Driver reconstructs support for the Goodix GDIX51C0 fingerprint sensor on Linux. It combines SPI transport, session and capture handling with a native ChicagoHS host-side biometric matcher, integrated through libfprint and fprintd patches. The source includes protocol research, algorithm comparison tools and deterministic tests.

A Python toolkit and protocol study reconstruct Insta360 GO Ultra control over Wi-Fi TCP port 6666. The protocol notes document length-prefixed protobuf command packets and H.265 video frames; the repository includes scripts for live preview and packet probing.

A Linux userspace daemon restores the Chuwi CoreBook X left speaker by configuring its AW88298 amplifier over I2C and mirroring the Conexant SN6180 HDA stream. The investigation documents the hidden I2S route, register behavior, volume mirroring and suspend recovery.

LIBREPODS-RS implements the AirPods Apple Accessory Protocol in Rust over Bluetooth L2CAP. Its core parses and builds AAP packets and decodes BLE advertisements, while Linux and Windows backends support battery status, noise modes, ear detection, and media actions; the project credits LibrePods as an inspiration and protocol reference.

Blue Star AC → ESPHome reconstructs the UART protocol of Blue Star smart-ready air conditioners and implements local control on an ESP32-C3. Its ESPHome component completes the Tuya MCU handshake, exchanges Blue Star DP101 key/value records and exposes climate controls to Home Assistant for tested IE518TNUR and IA318MXU models.

Intel NUC M15 Light Bar Control for Linux reconstructs the WMI commands used to set the laptop's front RGB light bar. A kernel helper invokes the F351 WMI transport, while Python tools send 0x0603 packets and expose named lighting states. The research notes map packet bytes to function, state, speed and brightness fields.

libfprint-microarray reconstructs the USB control workflow of the MicroarrayTechnology MAFP fingerprint reader as a Linux libfprint driver. Analysis of MicroarrayFingerprintDevice.dll and USB captures informs its handshake, image polling, fingerprint enrollment and verification commands. The author reports successful enrollment and verification on a physical 3274:8012 device.

ntrig-calib reconstructs the Surface Pro 3 N-Trig digitizer's calibration exchange as a Linux Python script. The project describes Ghidra analysis of CalibG4.exe and NCPTransportInterface.dll, including NCP framing, START_CALIB and GET_STATUS commands and HID report transport. The author reports a working fix on one device while documenting uncertain response behavior and calibration longevity.

even-utils explores the Even Realities G1 glasses protocol through an Android app. It builds custom Dashboard Map images and News source, text, creation and deletion messages, with BLE packet classes for these exchanges; navigation and standalone connection maintenance remain future work.

The Opel Insignia A Climatronic panel project investigates control of a 2015 facelift climate panel over LIN. It records the panel's connector pinout, identifies its LIN transceiver and provides STM32G431KB code and an image of observed LIN frames. The author describes the approach as brute force and based on an earlier panel investigation.

An STM32G431KB project investigates LIN bus control of a 2009 Opel Insignia climate-control panel. The author describes a brute-force approach without prior LIN frame ID information; the repository includes controller firmware, panel photographs and a frame image.

Peugeot 3008 II air conditioning unit investigates CAN control of the vehicle's climate module using brute-force frame-ID exploration. An STM32G431KB project drives the module's flaps and includes notes on its TJA1055 transceiver, sensors and actuators. The author reports testing a unit marked 9811039380.

BMW E92 CAN Live Data investigates CAN and OBD-II messages from a 2007 BMW E92 335d with an EDC16CP35 ECU. Using an ESP32 and TJA1050 CAN transceiver, the project sniffs CAN traffic and sends Mode 01 and Mode 22 PID requests; the author reports readings for coolant temperature, RPM, airflow and boost pressure.

Simplesoft RP5-TY-101 documents the function IDs and payload layouts used by a Toyota CAN interface box for aftermarket head units. Its tables cover responses such as door, tire-pressure, climate and radar state, plus head-unit requests for data and air-conditioning controls. A Python decoder is also present.

The BMW G08 heater blower project uses an STM32G431KB LIN master node to investigate which payload fields track blower drive voltage, current and fan speed. The repository includes controller firmware and images of the blower setup and serial monitor.

brscanner implements a Go USB client for scanning with the Brother DCP-1512E from an investigated device protocol. It provides a CLI for resolution, scan area and JPEG output, plus a Wireshark filter for examining USB captures.

SC75823 reconstructs Arduino control of the H-Buster HBD-2300MP front-panel display. It maps 156 individually addressable display bits to segments and symbols, and documents routines for seven-segment digits, fourteen-segment text and display-state updates.

Gree-Wired-Proto maps the RS-485 exchange between a Gree air-conditioner indoor unit and an XK19 wired controller. It records 1200-baud 8N1 serial settings, a 7E 7E header, source and destination bytes, body lengths, XOR checksum and observed message examples.

Nuga library implements Go control of BYK916 NuPhy keyboards through a reconstructed USB HID protocol. It reads and sets lighting effects and brightness, while its protocol notes map HID reports, response fields and custom per-key backlight colors.

Razer Nari Battery Level implements a USB HID exchange to read the headset's reported battery voltage through its dongle. The author captured SET_REPORT and GET_REPORT traffic and infers that two response bytes encode battery voltage in millivolts. A C program using libusb sends the requests and decodes those bytes.

Pix Backpack Go reconstructs local BLE control of PIX Backpack LED displays as a Go library and CLI. Its protocol notes and code cover GATT commands, RGB palettes, image and animation upload, live updates and scrolling text, drawing on app materials and local BLE experiments.

VFS495 fingerprint reader on Linux reconstructs capture and login support for the Validity USB 138a:003f sensor. It documents USB and secure-session behavior, descrambles captured images, and bridges the vendor-driven capture path to libfprint virtual_image, fprintd and PAM.

VTech VM901 reconstructs the camera's authentication and media workflow for a Home Assistant bridge. The Go and C implementation uses TUTK/Kalay transport, performs the documented X25519 and ChaCha20-Poly1305 exchange, decrypts H.264 and G.711 media, and publishes streams through go2rtc.

KATASYMBOL E12 Lab reconstructs BLE printing for E12-class label makers in Python. It combines a protocol library, command-line printer, Tkinter GUI and raw command harness, documenting GATT characteristics, 0x7E 0x5A command frames and compressed 512-byte raster frames.

GE Opal 2 research maps the ice maker's connectors, nominal voltages, plumbing and front-panel I2C communication to support an Arduino-based replacement control board. The repository includes protocol notes, a prototype schematic and firmware code. The author identifies incomplete connector documentation and unexamined front-panel and RGB behavior.