Reverse-engineering case studies.

magicJack HOME is investigated through its vendor macOS driver, USB register interface and captured SIP traffic to build a Linux-controlled analog phone endpoint. Python tools drive line power, ringing, hook detection and DTMF over hidraw, while baresip and a bridge connect the handset to a self-hosted PBX. The author reports live two-way calls on the resulting setup.

PyKS2 reconstructs the Pentax K-S2 camera's undocumented Wi-Fi HTTP and WebSocket interface as a Python library, CLI and camera simulator. Its protocol notes map endpoint groups, request behavior, live view and event streams, backed by captured responses from firmware 01.10.

ESPHome — Maytronics Air Cover BLE recreates pool-cover control through a BLE GATT profile observed in the official Android app. Its ESPHome configuration sends open, close and stop payloads and reads position and motor-state notifications for Home Assistant.

RevCar CLI is a Python controller for WowWee RevCar toys built from BLE command observations. Its notes identify GATT handles for notifications and commands, describe the handshake and driving payloads, and include a captured HCI exchange.

Open Steigen documents the local control protocol of Steigen Automatic Laundry Systems, including readable and writable data points for rack movement, lights, fan and heater. Its pairing notes describe the appliance's Wi-Fi setup exchange; the author reports testing the Solar model with protocol v3.3.

The Tchibo 287717 investigation decodes its weather sensor's 433.85 MHz OOK transmissions. Captures and display comparisons support a pulse-distance message layout with repeated frames and mapped temperature and humidity fields.

BPM documents a study of USB communication with the Aponorm Blutdruckmessgerät Oberarm Professionell blood pressure monitor and provides a Python reader for backing up measurements on Linux. The reader sends a serial command, parses cycle records containing timestamps and blood pressure values, and stores measurements in SQLite.

deco-network-optimize implements the TP-Link Deco app's private TMP/App-V2 Network Optimization sequence for a Deco X20-DSL. It opens an SSH direct-tcpip channel to tmpsvr, sends scan and poll commands, and requests channel optimization when the device reports an optimizable state. The accompanying protocol notes document framing, checksum and the recovered command opcodes.

An STM32U545RE project reconstructs the LEGO SPIKE medium motor's UART startup exchange from observations of the original hub. It reproduces the handshake and heartbeat so the motor sends speed, single-turn position and accumulated angle frames at 115200 baud.

An ESP32 client investigates the BC54 blood-pressure monitor's BLE exchange and parses measurements from the Blood Pressure Service. Its notes map the measurement flags, pressure values and optional fields and describe bonded, encrypted pairing.

The LD2410S investigation documents the I2C and SPI traffic between a Hi-Link FMCW radar board's components and examines its Puya controller firmware. It includes Saleae captures, oscilloscope images, an interpreted Range FFT frame, firmware strings and an interrupt vector map. The author labels the investigation as work in progress.

MiniToo Pixeldeck implements and documents the Divoom MiniToo's Bluetooth Classic display exchange. Its Python driver frames and uploads JPEG or optional Zstandard RGB pixel data, while research notes record observed media-button input paths and their limits. The toolkit includes interactive pixel demonstrations and protocol diagnostics.

fnb58-ble-logger reconstructs the FNIRSI FNB58's Bluetooth LE measurement exchange and logs voltage, current and power to daily CSV files. Its Linux daemon writes the stream-start commands, reassembles notification frames and decodes type 04 measurements; the repository documents the observed GATT layout and frame format.

KBM TG700 Control reconstructs the USB HID settings protocol of KBM! GAMING TG600 and TG700 keyboards from analysis of their Windows software. Its Linux GTK4 app sets lighting, macros and key mappings through hidraw, and the protocol document records report fields and command codes. Hardware testing is reported for the TG700.

ssmouse implements a client for the SteelSeries Rival 3 Wireless HID protocol recovered from SteelSeries GG. Its Rust tray app and CLI read battery and device events and set DPI, polling, lighting, buttons and power options; the repository documents report framing and commands.

KuKirin G2 Master UART protocol documents the single-wire link between the display and Lenzod controller of a late-2025 Version C scooter. It identifies inverted 230400-baud signalling, 66 66 frame headers, CRC-16/MODBUS and fields for controls, speed and battery voltage. Python tools decode logic-analyser captures and display live values.

RJ Connect documents Ruijie campus-network authentication at the packet, field, cryptographic and state-machine levels. Its Zig library implements the studied macOS 1.35 and MentoHUST 0.3.1 wired EAP-MD5 profiles, including private tail fields and session transitions. PEAP and Direct paths remain internal research modules.

aula-hero68-protocol documents the HID lighting protocol of the AULA HERO 68 HE keyboard. It specifies the 64-byte output report, checksum, lighting commands and per-key payloads, and includes a key map calibrated by lighting and pressing individual keys. Capture parsers and a device test script accompany the protocol notes.

MCHOSE V9 Turbo+ protocol research reconstructs the headset's USB HID RGB control exchange. It documents the 65-byte Windows write buffer, lighting fields, ACK draining and a 0x07 status query that reads back color values. C# and Python probes exercise the commands against the device.

sindri-led reconstructs the K671 Sindri keyboard's HID lighting controls from study of the Windows software and device responses. The Linux Rust CLI changes effects, brightness and lit keys through feature reports, while protocol notes record report IDs and field layouts. A separate map links report positions to physical keys on one Latin ISO keyboard.

clevo-wmi-rgb documents the WMI commands used to control keyboard backlighting on a Colorful X15 AT23 laptop with a Clevo NP50SNE chassis. Its protocol notes describe CLEVO_GET.SetKBLED color packing, zone values, power and brightness commands; PowerShell scripts probe the interface and register its WMI class.

Osmo+ Studio reconstructs DJI Osmo+ camera control and live video transport over Wi-Fi in Python. Its DUML parser and probes document frame checksums, gimbal and zoom commands, exposure settings, and the H.264 stream handshake and sequence acknowledgements. The desktop app routes the camera feed to OBS Virtual Camera.

cherry-mx-lighting-mac reconstructs lighting control for the Cherry MX 10.0N RGB keyboard in a macOS menu bar app. The author observed Cherry Utility's USB HID traffic and documented a five-report sequence, including bytes for effect, brightness, speed and RGB colour; the app also remaps keys through hidutil.

labelibre implements direct Bluetooth printing to the SUPVAN T50M Pro using protocol knowledge from community analysis of the Katasymbol app. It parses Labelife AML labels into one-bit images, compresses print buffers with LZMA and sends data frames through a BLE transport from a macOS app or CLI.

synaptics-009b-fprintd reconstructs Linux support for the Synaptics Prometheus 06cb:009b fingerprint sensor. Its Rust modules handle USB transport, encrypted frame capture and host-side matching, while a D-Bus service presents the device through fprintd interfaces.

STRIDE reconstructs the FitPro motor-board interface for a replacement Android console app on a NordicTrack treadmill. Its protocol notes document the USB HID transport, message frames and commands derived from traffic analysis and software examination. The app communicates with the board over USB and can publish treadmill telemetry through MQTT.

TonePush reconstructs the Line 6 HX USB editor protocol in reusable Rust crates, a CLI and a desktop editor. Captures from HX Edit and an HX Stomp informed packet framing, preset documents, backups, settings and impulse-response transfers. The same interface also supports StompStation PRO through its separately documented device protocol.

ESP32Drop reimplements Apple Wireless Direct Link and AirDrop on an ESP32-S3 from observed traffic. Its Arduino library and example sketches receive files from, or send a file to, nearby Macs and iPhones over a direct wireless link. The implementation includes AWDL framing and AirDrop transfer components with host tests based partly on captured traffic.

Valeton GP-50 Editor controls GP-50 and GP-5 guitar pedals through a reconstructed MIDI SysEx protocol. Its browser interface uses WebMIDI to inspect and edit presets, reorder blocks, rename slots and convert GP-5 and GP-50 .prst files. The repository also includes protocol tooling and findings about the vendor's NAM-to-SnapTone conversion path.

r8link reconstructs the Uniden R8w radar detector's Bluetooth LE data exchange as a Python client and protocol reference. The author used JADX on the R/Tach Android app and captured live traffic, then implemented parsing for alerts, frequency, signal strength, direction, device telemetry, and stored camera points.

esphome-panasonic-erv replaces a Panasonic ERV's optional module with an ESP32-S3 that speaks the reconstructed CN12 serial protocol. Logic-analyzer captures underpin its frame decoder, command builder and ESPHome component for power, mode and fan control. It exposes state to Home Assistant, which can make the controls available through its HomeKit Bridge. The author reports physical testing on FY-25ZDP1C.

EdgeLine investigates the Corsair Xeneon Edge display's Linux control interfaces and provides a panel control app. Its notes record the vendor HID report layout and separate touch-controller descriptors, while the app uses HID for brightness, ddcutil for picture settings and xinput for touch modes. The HID command table distinguishes observed behavior from candidate commands.

FreeMicro implements Codex Micro key input and LED output through the device's vendor HID protocol, linking six keys to Claude Code project states. Its protocol notes describe different USB and Bluetooth LE report framing, device commands, and observed input events, with Python code for device control.

The Mittzon Standing Desk project investigates the LIN bus between an IKEA Mittzon desk controller and its handset. Its ESPHome configuration reads position frames through an ESP32 and controls the desk by electrically emulating panel buttons, exposing height and movement controls to Home Assistant.

zenvision-linux reconstructs USB control of the ASUS ZenVision lid OLED on the Zenbook 14X OLED Space Edition. Its Python driver sends 256×64 grayscale frames through a documented command handshake and bulk endpoint, supporting images and animations on Linux.

orba-protocol reconstructs the Artiphon Orba 2 control protocol across USB-MIDI and BLE-MIDI. Its specification maps SysEx framing, codec, CRC and device registers, while Python and JavaScript libraries decode messages and build commands for device settings. The author reports comparing the implementation with captured traffic and live responses.

TrikiEmu recreates the Żabka Triki motion controller's BLE behavior on ESP32 firmware. It reproduces advertising identity, a Nordic UART Service profile and 14-byte IMU frames using findings from TrikiScope and Android HCI captures; PC tools feed keyboard, CSV or recorded motion to the emulator. The author reports that Żappka connects and reacts to movement on M5StickC Plus2.

TrikiScope investigates the Żabka Triki controller with a Python BLE terminal inspector. It inventories GATT services, decodes 14-byte gyroscope and accelerometer frames, identifies a button flag and LED control bit, and provides diagnostic probes and CSV recording.

G2CC reconstructs communication with Even Realities G2 smart glasses through a replacement Android BLE client and a PC-side display compositor. Its protocol documentation describes captured Bluetooth frames and the display, input and battery exchanges used by the client.

Melitta Barista & Nivona for Home Assistant implements Bluetooth LE control of supported coffee machines through their shared Eugster/Frismag protocol. Its reference maps GATT characteristics, the HU handshake, encrypted frames, and status and brew commands. The integration exposes machine state and settings; Melitta models also have recipe and maintenance controls. Nivona support is in alpha.

OpenHX implements selected Line 6 HX and Helix preset controls in a Rust CLI and includes an early GUI. USB captures between HX Edit and an HX Stomp XL informed its bulk-transfer transport, session handshake and preset operations. The published protocol notes cover packet sequences, MessagePack preset data and device quirks.

BunATV reconstructs Apple TV control protocols as a Bun and TypeScript library with a companion CLI. It implements Companion pairing and remote input, MRP playback and state messages, and AirPlay transport layers, exposing messages close to their wire format. The author credits PyATV research and reports finding additional MRP messages through Ghidra analysis of Apple frameworks.

The Ember Mug app decodes the undocumented fc540013 Bluetooth LE statistics stream from an Ember Mug 2 into a drink log. Its format notes describe notification fragments, record fields, timestamps, and the device's backlog behavior; the macOS menu-bar app combines decoded records with its own live readings.

PreSonus Quantum Linux documents control and audio behavior of the Quantum 2626 Thunderbolt interface while developing Linux support. Its research records channel routing and the recovered TCI protocol, with an in-house driver retained as a fallback beside builds of a separately authored upstream RFC driver. The author reports bounded playback and capture tests and unresolved stability issues.

Berbel Remote Emulator recreates BFB 6bT, 8bT and 7bT remote commands on ESP32 firmware for Berbel kitchen hoods. It decodes hood status frames and exposes controls through MQTT and Home Assistant. The protocol research uses BLE captures and a Linux fake hood that pairs with real remotes to record button notifications and test status frames.

The KuKirin G4 BLE Mode Monitor parses observed FFF2 notifications from a scooter and prints changes between ECO, SPORT, and RACE modes. Its Python client validates frame length and a gate byte before decoding the mode field; the documented mapping comes from one scooter and firmware combination.

Mutant Brain's SysEx configuration format is mapped through comparisons of generated presets. The repository records message boundaries, four-byte configuration chunks, object IDs for inputs and CV or gate outputs, and parameter IDs for settings such as channel, pitch bend and trigger mode. Sample .syx mappings accompany the findings.

The TBBT A9 mini camera investigation reconstructs the camera's PPPP login and video-start exchanges over UDP/32108. It documents command framing, plain-text login and the raw session ticket, then patches aiopppp; the author reports MJPEG streaming through Home Assistant.

loxone-link-dotnet implements the Loxone Link NAT protocol over CAN in a .NET 8 library. It models extensions and Tree devices, handles framed messages and challenge flows, and includes device simulators plus a CAN capture harness informed by prior Loxone research.

Polycab Solar Inverter to MQTT reads Bluetooth telemetry from a PSIS-3K-SM1 inverter using values the author says were recovered from its Android monitoring app. A Python service publishes solar power, voltage, current, temperature and energy readings to a Mosquitto MQTT broker.

aquacomputer-quadro-control reconstructs USB configuration access for the Aquacomputer Quadro fan controller. Its Linux client reads saved settings and changes fan, sensor and RGB values; accompanying captures document packet offsets, checksum placement and a usbmon capture workflow.

HT2000Lib implements a C# client for the HT2000 CO2 logger using a USB HID interface recovered by monitoring the manufacturer's Windows application at runtime. It documents status and historical log reports; the author reports that its native Windows backend reads current sensor state and dumps stored measurements.

The ASUS XG34WCDG reference maps DDC/CI controls for display modes, colour, HDR, OLED care, proximity sensing and Aura effects. It correlates VCP values with on-screen changes and reports observed write and readback behavior on one unit, while separately describing the USB Aura interface from host records and published sources.

The MSI Optix G27C2 reference maps the monitor's DDC/CI controls from Windows API reads and writes on one unit. It records VCP codes for brightness, contrast, colour presets and input selection, along with I2C pacing, ignored writes and EDID data.

QCYbutMOD is an Android client built from reverse engineering of the BLE GATT commands used by QCY earbuds with Wuqi WQ7033 and WQ7034 chips. It reads separate earbud and case battery values from characteristic 0008, sends a command to mute firmware voice prompts, and reads back gesture mappings. Device test notes record command acknowledgments and unanswered multipoint queries.

The Lian Li UNI HUB SL V2 reference reconstructs the controller's USB HID commands for fan duty, RPM reporting, LED effects and motherboard passthrough. It compares an L-Connect 3 USB capture with independent tests on one hub and records report layouts, command sequences and timing.

SAC9010QC/SAC12010QC reconstructs the IR control format of a HomeFit Living or Alaska air-conditioner remote from captured signals. A protocol reference maps its 36-bit command fields, while an ESP8266 or ESP32 web server sends AC settings through a REST endpoint.

hydrao-dump investigates the Bluetooth exchanges between Hydrao shower heads and their phone app, with packet captures, a Wireshark dissector and an MQTT receiver for Home Assistant. The author identifies shower volume, color thresholds, firmware and hardware versions, and device IDs while leaving temperature and flow fields unresolved.

LibreConga investigates the Cecotec Conga 5490 robot vacuum's communication protocol through captured app traffic. Its notes describe frame lengths, identifiers and sequence fields for ping and login exchanges, with a separate table of observed command opcodes.

The FT017TH study decodes transmissions from a wireless thermometer and hygrometer. It documents Manchester encoding, repeated messages, field positions and formulas for estimating temperature and humidity from captured data and displayed readings.

mg6250_mqtt reconstructs part of the Paradox MG6250 alarm console's serial event protocol. It documents frame lengths, event fields and CRC-16/MODBUS checksums, and provides a Python test client plus an ESP8266 sketch that forwards decoded events to MQTT.

Tanzmaus Sysex Parser investigates MFB Tanzmaus MIDI SysEx bank dumps. It decodes the 7-bit transport encoding into pattern payloads, maps step, mute, flam, knob and LFO fields, and supplies scripts for extracting and comparing individual patterns.

avea implements Python control of the Elgato Avea bulb using a BLE protocol investigated through an Android btsnoop log and Wireshark. Its documentation maps the control characteristic and color, brightness and name commands; the library discovers bulbs and reads or sets their state through Bleak.

Cetus3D reconstructs status communication between UP Studio and a Cetus3D printer using Wireshark captures and experiments. Python and Arduino implementations discover the printer and query print progress, layer, remaining time and temperature; the capture notes describe network message exchanges.

LILO reconstructs Bluetooth Low Energy control of the Prêt à Pousser LILO device in JavaScript. It identifies a service and separate characteristics for lighting and time, with methods to read and write those settings and a map of lighting modes.

helix investigates USB HID communication with the DNA 75 vaporizer controller while prototyping configuration from Linux. It records the device's USB descriptors and describes capturing transfers through usbmon and Wireshark after triggering actions in a Windows virtual machine.

Ha-Kake documents how Nissan Leaf CAN and OBD-II signals were identified and decoded for a local vehicle dashboard. The repository pairs signal byte tables and an eight-chapter investigation guide with a Python reader, vehicle profiles, replay tools and a simulator.

The Ökoboiler study reconstructs the single-wire UART exchange between a heat-pump water heater's display and control boards. It documents 32-byte frames, XOR masking, CRC-16/Modbus and fields for tank temperature, operating mode and PV state, with a Python decoder and an ESPHome sensor configuration.

ritto-esp investigates the Ritto 7630 TwinBus intercom's board signals with oscilloscope captures, distinguishing apartment and street bell events by their chime and apartment-line behavior. An ESP32-C6 running ESPHome exposes separate bell sensors and a door-open command to Home Assistant through optocoupled inputs and output.

ha-c14 documents the C14 RS-485 bus between a COMPIT AERO 3B ventilator and Nano Color CTP room panel and implements an ESPHome bridge for ESP32. Its protocol notes describe 30-byte frames, master cycles and device roles; the YAML package parses frames and exposes controls and sensors to Home Assistant.

Homiq Rescue documents the ASCII frame protocol used by older Homiq home-automation systems through a Moxa NE-4110S serial-to-TCP bridge. Its toolbox sniffs and sends frames, extracts backup data to JSON, and supplies Node-RED flows and a TCP emulator for integration work.

PreSonus StudioLive 16.0.2 USB documents control messages exchanged between the digital mixer and Universal Control software. Based on Wireshark captures, the notes describe vendor USB requests, response chunking, split-nibble values and commands for status, MIDI settings, channels and system controls.

DJI Mic Mini Monitor reads transmitter battery and charging state from the receiver's USB status stream on Windows. Its Python reader uses WinUSB, while protocol notes describe MI_06 bulk endpoints, frame boundaries, CRC checks and status offsets; the author reports checking those details against a local receiver.

baseus-cli controls Baseus Bass BS1 NC earbuds on Windows through a reconstructed Classic Bluetooth RFCOMM protocol. Its Python client reads and changes ANC, spatial audio, EQ, bass boost and other settings; a protocol map and research scripts document frame opcodes and state-difference experiments.

hxoctkl reconstructs USB HID profile control for the HyperX Alloy Origins Core tenkeyless keyboard and writes persistent per-key RGB animations from Linux. Its protocol notes specify 64-byte reports, command opcodes, colour-buffer packing and the upload and commit sequence. The research used device queries and one NGENUITY USB capture, and builds on OpenRGB's earlier findings about colour-buffer packing.

Wireless Doorbell Clone reconstructs the Grundig QH-831A doorbell remote's transmitted data frame and implements transmitters in Arduino and MicroPython. The notes give the bit sequence and 475 µs and 1435 µs pulse lengths, while the repository includes captured radio data.

Lucci Air Homey App reconstructs the 433 MHz control protocols of USB-C and CR2032 Lucci Air fan handsets from recorded transmissions. Its Homey drivers learn a handset address and send fan and light commands; separate protocol documents describe frame layouts, command codes and observed hardware behavior.

Taktil implements wired AULA F99 control through a Rust HID adapter and a Tauri desktop interface. Its protocol study uses static analysis of the vendor driver and KB.ini to document report layouts, keymaps, macros and per-key RGB commands, marking observed and inferred behavior separately.

MG330 Studio recreates configuration control for the 2E Gaming MG330 RGB mouse on macOS using the SPCP6651B HID feature-report protocol recovered from its Windows driver. It reads and writes the device's 2 KB configuration, covering RGB zones, DPI, polling rate and effect slots; protocol notes map report IDs, offsets and checksums.

qutie implements Linux printing for the PRT Qutie label printer using a recovered Bluetooth Classic RFCOMM protocol. Its notes document handshake, session XOR, status responses and LZO raster commands derived from printer observation and HerePrint app analysis; a Python library, CLI, CUPS components and Qt designer use the protocol.

Hush is a macOS menu-bar and command-line client for Sony WH-1000XM6 headphones using their MDR protocol over Bluetooth RFCOMM. It documents frame escaping and request sequencing, and implements noise control, equalizer settings, battery reporting and DSEE; WH-1000XM6-specific ambient and equalizer behavior is described.

The Aromatic BLE bridge connects an AF300 Smart scent diffuser to Home Assistant through an ESP32 running ESPHome. Its BLE protocol was derived from Android-app analysis and device probes; the bridge reads and writes power, fan and schedule settings, while protocol notes document GATT characteristics, login frames and commands.

Teclado RGB via USB HID reconstructs the Redragon K552-M keyboard's lighting commands from captures of its official software. The author identifies a vendor-specific HID interface, 64-byte reports, color frames and a heartbeat; PowerShell tools send captured frames and adjust lighting effects.

wibox-daemon reconstructs Fermax Wi-Box IDS7938 communication in a Go service for door control and media access. Its protocol reference describes cloud userauth XML, UST MQTT discovery, an RB-UDP tunnel and local QUII. The daemon exposes HTTP controls and outputs H.264 video with optional G.711A audio.

MousePods reconstructs AirPods 3 RemoteHID motion access and uses it for Linux cursor control. Its protocol reference specifies AACP transport, RTBuddy framing, device announcements and reports; capture files document the receive-MTU difference that exposes motion sensors. The project also describes a SensorDataWX path for AirPods Pro 2.

FitFace Studio reconstructs Galaxy Fit3 watch-face editing and Bluetooth delivery in an Android app. It parses and rewrites the face's binary container, validates its size and content, and documents the RFCOMM transfer sequence used to send it to an SM-R390 watch. The editor supports backgrounds, widgets and styles while retaining projects on the phone.

fretwire reconstructs the Line 6 HX family’s USB control protocol for an independent Linux editor. Its Rust code covers device sessions, message encoding, preset parsing, and a graphical editor; protocol notes describe captured MI_00 frames and request-response behavior. Model and control data are imported from the user’s HX Edit or POD Go Edit installation.

Kreo Hive 65 RGB Control reconstructs the keyboard's USB HID lighting exchange and implements Linux command-line, desktop and WebSocket controls. Its protocol document specifies the vendor interface, feature report 6 and a 520-byte per-LED RGB frame derived from descriptor analysis, usbmon capture and live probing.

The Cavium SNIC10E project reconstructs a PCIe BAR2 shared-memory datapath for the CN6640-SNIC10E card. Host and card drivers exchange packets through per-port rings, with PIO transmit and DPI DMA receive, while boot tooling loads OpenWrt into card RAM. The author reports bidirectional traffic on two 10 GbE ports and documents unstable simultaneous load.

Deadband reconstructs configuration exchanges for GameSir controllers and the Logitech G502 X LIGHTSPEED mouse in a Linux GUI. Its research notes connect USB identities, hidraw and evdev probing, USB captures and device registers to controls for lighting, profiles, remapping, curves and macros.

Pocket Libre reconstructs the Pocket AI recorder's BLE command and audio-transfer behavior in a Python client. Its protocol notes map APP commands, MCU responses, GATT characteristics and MP3 streaming from HCI captures; the client downloads recordings and offers local transcription and speaker identification.

Open Apollo reconstructs Linux control of Universal Audio Apollo Thunderbolt and USB audio interfaces through hardware and driver analysis. It provides a Thunderbolt kernel driver, USB initialization stack, mixer daemon and native console, with device setup drawing needed files from the user's UAD installation.

attack-shark-x11-driver reconstructs Attack Shark X11 mouse configuration over USB HID as a TypeScript client. It provides DPI, profile, button, macro, lighting and polling-rate controls, plus device-state reads. Its protocol notes draw on USBPcap and Wireshark captures, HID feature reports, official software analysis and firmware investigation.

Hisense/Hitachi H-NET-Protocol investigates the H-NET bus used by Hi-Therma and Air H₂O 400 heat pumps. Its documentation maps controller connections on an AHZ-080HCDS1 unit and describes the two-wire HBS signaling, frame fields and checksums.

YenKeyControl reconstructs the Yenkee YKB3700 Rogue keyboard's USB HID configuration protocol and implements Python commands for RGB effects, per-key colors and key remapping. Its protocol notes specify packet layouts, command values, checksums and sequencing derived from captured USB traffic and parameter tests.

Deye Battery Serial Bus maps CAN frames from a Deye battery system and reads RS485 cell-voltage data. Its frame reference associates identifiers with inverter, battery and BMS fields; a .NET service exposes readings through API endpoints and includes Grafana dashboard definitions.

Bonaparte implements a Python client for Napoleon eFIRE fireplace controllers and documents their Bluetooth LE control protocol. Its reference specifies GATT characteristics, request and response packet fields, XOR checksums, and commands for settings such as power, thermostat, and night-light level.

skyrcUSB implements a Python client for a reverse-engineered skyRC charger protocol. Its Charger API reads cell voltages, charger settings and live charge data; the author reports testing it with a D100V2 and limits the library to read operations.

mqtt-energi investigates myenergi device-to-device Ethernet traffic and bridges decoded readings to MQTT. Its documentation records multicast frames with ethertype 0x88b5 and packet layouts, while a Python decoder extracts voltage, power, energy and heater state from Eddi V2.1 messages.

RedFIS investigates the Audi A3 8P dashboard Driver Information System protocol and implements an alternative display controller on ESP32. Its source covers CAN communication, VWTP handling, display decoding and wiring for supported instrument clusters.

GalaxyBuds-rs implements Galaxy Buds Bluetooth messages as a Rust library. It receives status, touch, voice-wakeup and debug updates and sends controls for noise reduction, equalizer, touchpad settings, muting and finding earbuds, with examples that connect using a device address.

ETEKCITY Smart Nutrition Scale research maps the ESN00 scale’s Bluetooth Low Energy characteristics and packet payloads. A TypeScript package parses and serializes identified commands and measurements for units, tare, automatic shutoff and scale state; the documentation lists packet types still under investigation.

mi-scale-2 decodes Xiaomi Mi Smart Scale 2 BLE weight data and publishes the readings to MQTT. Its format notes identify unit, stabilized, and weight-removed bits in the first byte and a little-endian weight value in the next two bytes.

PSA VAN Bus documents vehicle bus packets researched chiefly on a Peugeot 307 and described as applicable to listed Peugeot and Citroën models. The repository stores packet descriptions in JSON files and displays them through an HTML page; it reviews earlier VAN findings and adds observations.

Apple Wi-Fi Password Sharing reconstructs grantor and requestor behavior for Apple's Wi-Fi password-sharing protocol on macOS. Its Swift code handles BLE discovery and pairing, while a Python GATT relay on Linux supports the requestor role.

Schellenberg USB protocol research documents communication with the 21009 Magenta SmartHome dongle through its USB serial interface. The reference lists operating modes, command responses, message fields, device identifiers and commands for paired Schellenberg devices, with receive and send examples.

433home reconstructs the 433 MHz control signals of REV wireless power sockets. The author measured remote-control output with a receiver and logic analyzer, documented pulse timings and 25-bit on/off commands for three sockets, and implemented an ESP8266 web frontend that transmits those sequences.

fcp-stuff documents the FirstClass client-server protocol over TCP. Its notes cover command constants, packet structures, login, encryption, and the Docedit document format; the repository also contains JavaScript proxy code.

Orthoplay records a reconstructed WebSocket exchange for the OD-11 speaker. It identifies development and production endpoints and supplies JSON messages for session join, remote registration, periodic ping, and group volume changes.

Chsmartbulb documents Bluetooth control of a combined RGB bulb and speaker sold as BL08A. The author captured traffic from an Android phone and provides a script that replays color-control sequences; the findings identify SPP over Bluetooth EDR as the app's color-control channel.

mf4700-print-scan reconstructs printing and scanning for Canon MF4700-series devices in a macOS app. Its C encoder emits UFR II LT jobs based on differences observed in Canon driver output, while an MFNP client registers the Mac and retrieves scanned pages. A format reference records CPCA packets, job structure and print-data encoding.

Kenwood KNS documents the ARCP-590G client's communication with a TS-590SG radio over serial and KNS TCP connections. The investigation compares Wireshark captures with CAT commands and records UTF-16LE encoding, connection sequences, cleartext authentication, and keepalive traffic.

truemove3-re records an investigation of the TrueMove3 gaming mouse sensor's SPI interface. It lists the pinout, bus settings, register addresses, and a startup exchange observed from a Rival-310, while leaving differences from the PMW3360 unresolved.

Implements access to the Aqara G410 doorbell through cloud calls and a P2P connection reconstructed from the Aqara Home app. The macOS client provides live view, talkback and event history, while a notifier sends motion media to Matrix. Protocol notes record request signing, login, event queries, media decryption and the P2P handshake.

crowdstrike-cloudproto reconstructs the cloud protocol used between Falcon Sensor and its TS event and LFO file services as an asynchronous Rust crate. It implements common packet framing, TS event exchange, and LFO file downloads; the protocol notes describe Protobuf event payloads, acknowledgments, and LFO request and response packets.

Reconstructs the Basike BA-KEY308 keyboard's HID configuration protocol from the vendor's Windows app and implements it in a macOS menu-bar app and CLI. The protocol notes cover Feature reports, command classes and Bluetooth, USB and 2.4 GHz receiver transport. The app controls lighting, per-key colors and profiles.

KC Control implements Keychron M6 profile switching over a reconstructed HID command exchange. A Windows tray app watches the foreground program and selects an onboard mouse profile; its protocol reference documents report IDs, framing and commands derived from the Launcher web bundle and a live device capture.

Reconstructs the 433 MHz RF remote protocol of the non-Wi-Fi Xiaomi Whale Spout bidet seat and implements it in ESPHome on an ESP32 with a CC1101 radio. The project documents 2-FSK timing, 32-bit packets, settings fields and checksum behavior, then exposes control and remote-state monitoring through Home Assistant.

skypsu reconstructs the Modbus RTU register map of the SKY TOPPOWER STP2S3010E22 laboratory power supply. It provides a Python driver, read-only register scanner, local web interface and live plot. The documented map covers output control, measurements, setpoints and status flags; the author reports checking it on two units.

Smart-AC-Modernizer documents the Haier YRW02 air conditioner's infrared control format and implements an ESP32 bridge for it. The author identifies a 112-bit NEC-variant state packet, captures remote signals with a TSOP4838 receiver, and sends decoded commands through a transistor-driven IR LED.

Implements the iDotMatrix BLE display protocol as a typed Python SDK while documenting findings from vendor APK analysis and hardware probes. Packet builders cover images, GIFs, text, effects and native display modes; a bundled CLI decodes Android btsnoop captures into annotated traffic. The project records feature status against a reference 32×32 panel.

Skannerz Commander trade research reconstructs the electronic toy's three-pin exchange protocol from a 200 kHz logic-analyzer capture and controlled hardware experiments. Its documentation covers clock phases, handshake, frames and monster payload fields; an Arduino slave emulator implements the exchange, which the author reports using in real trades.

AUKEY KM-G15 RGB Control reconstructs the keyboard's USB HID lighting protocol and supplies a Go command-line client. Its protocol notes define 64-byte SET_REPORT packets, a checksum and START–command–END transactions; the client changes lighting modes, brightness, profiles and polling rate.

SonyBridge extends a desktop Sony headset client to handle a second generation of its Bluetooth RFCOMM control protocol. It documents frame boundaries, service UUID families, the v2 initialization handshake, host acknowledgments, and commands for battery, equalizer, and DSEE data. The app offers controls on macOS, Windows, and Linux.

The HP Laser 1008a project reconstructs the SPL3/QPDL printing path for HP Laser 1003, 1006, and 1008 devices on Apple Silicon macOS. The author compares HP and SpliX streams, documents the page and band records, and patches a page-header size mismatch. A native CUPS filter and IOKit backend send the resulting output over USB.

BMW iDrive Controller CAN Bus Interpreter decodes controls from an F44 iDrive controller using an ESP32-C3 and TJA1441A/B CAN transceiver. It reports knob rotation, joystick directions, button and touch states, and brightness commands at 500 kbps. The README also records unresolved touchpad decoding and CAN wake-up behavior.

ESP32 Controller for Charlton & Jenrick Fireplace recreates remote commands by transmitting captured RF payloads through a CC1101 module. Its firmware provides iRange 2-FSK and non-iRange ASK/OOK profiles, with controls exposed through a web interface, MQTT and Home Assistant.

GMK87 Configurator reconstructs the Zuoya GMK87 keyboard's USB HID control exchanges from captures of its official application. It documents 64-byte report framing and image-upload sequences, and provides desktop, CLI and Node.js controls for display images, RGB lighting and clock synchronization.

Ajazz AK820 Pro Linux Software reconstructs lighting control for the Ajazz SONiX AK820 Pro keyboard from USB traffic captured with Wireshark and PCapUSB. It includes a PCAP packet parser and a Linux HID application; individual LED control, macros and LCD images remain planned.

OPUS-QUAD Pro DJ Link Reverse Engineer Packet Analysis documents how the Pioneer DJ OPUS-QUAD exchanges Pro DJ Link packets. It describes UDP announcements on port 50000, status traffic and metadata requests on port 50002, alongside a Node.js example that relays status packets to a WebSocket server.

MiraBox StreamDock reverse-engineer is a TypeScript demonstration of direct USB control derived from the device's packets. It reads firmware versions and key presses, controls screen state and brightness, and sends key and boot images through a replaceable USB backend.

SiriRemote-Linux decodes Apple TV Siri Remote Bluetooth input for use on Linux. Its Python code connects to the remote and emits media, volume, and pointer controls, while the documentation maps GATT characteristics, battery notifications, button bits, and touch coordinates. Microphone data remains unexplored in the implementation.

ZydDash builds an ESP32 dashboard for an ePowerFun ePF-1 scooter from decoded Zydtech BLE telemetry. Its notes map Bluetooth characteristics, a 115200-baud display bus, MODBUS-like command frames and registers, while Python examples read and interpret scooter telemetry.

catlink-local reconstructs the CATLINK Open X litter box's login and MQTT exchanges for local Home Assistant use. Python services answer its login request, decode heartbeats and visits, and bridge state to Mosquitto; protocol notes distinguish confirmed fields from hypotheses.

Aurora reconstructs EvoFox Blaze mouse configuration through its Linux hidraw interface. A CLI and terminal UI read and change polling, DPI, lighting, button and profile settings, with writes checked against the device's returned state.

CR-BYOB reconstructs Creality Scan Bridge behavior in an Android app, letting Creality Scan discover a USB-connected scanner over a network. Its Java source handles scanner capture, bridge discovery and streams, with documentation for the communication paths and device compatibility.

HappyLighting-py reconstructs BLE communication for HappyLighting-compatible LED controllers from analysis of the original APK. Its Python app changes color, mode and speed, enables the integrated microphone and drives color from screen input.

pd-usb implements Playdate USB communication in a JavaScript WebSerial library using commands recovered through packet sniffing. It reads device status, controls and screen data, sends bitmaps, and exposes command and compiled-Lua payload operations.

GlanceClock documents the wall clock's BLE command protocol for building a local bridge. The reference identifies its GATT service and characteristic, protobuf payloads, pairing flow and commands for notifications, scenes, settings and timers.

prolink-connect implements Pioneer PROLINK network exchanges in TypeScript for DJ equipment. It discovers devices through UDP announcements, joins as a virtual CDJ, receives player status and queries track metadata from Rekordbox-formatted media or a Rekordbox link.

Open Remote Start investigates the antenna data-link protocol of Fortin remote starters and alarm systems. Its Particle firmware implements an interface that can monitor the link and serve as a cellular or Wi-Fi remote, with an EVO-One port pinout and wiring schematic.

PythonWifiBulb reconstructs MagicLight Wi-Fi bulb control from captured phone-to-bulb traffic. The Python class sends RGB and warm-white commands over TCP, while its notes describe port 5577, message bytes and a checksum helper.

Laser Drift emulates the infrared controllers of Carrera Digital 132/124 slot cars. A Python game loop synchronizes with the IR tower, encodes player state into controller packets and accepts speed and lane-change commands from a TCP server.

mx3000control configures the Perixx MX-3000 mouse on Linux using HID feature reports recovered from its Windows driver. The C tool sets DPI, sensitivity, LED behavior, buttons and macros; a development log documents analysis of the mouse communication.

jeep-canbus documents byte-level meanings of observed CAN-B frames in a Jeep Grand Cherokee WH. The repository combines capture-based ID maps with an ATmega328 radio gateway and an ESP32 dashboard that receives and interprets vehicle data.

Samsung Galaxy Book4 Edge Linux Research & Support investigates the ENE KB9058 embedded controller and its I2C mailbox communication. The author describes static analysis of the ARM64 EC2.sys driver and provides EC probing scripts, protocol notes and a Linux battery module for the laptop.

Bose-Reverse-Engineering investigates the SmartSpeaker link between a Bose 321GS Series III console and bass module. The author documents connector pinouts, probes a 4800-baud half-duplex UART exchange, and provides Arduino firmware and KiCad hardware for a replacement console.

The Pioneer DJM-850 study maps USB exchanges between the mixer and its Windows driver and Setting Utility to inform Linux support. Captures and notes cover mixer input and output choices, ASIO settings, DVS timecode and music transfer, channel routing, sample rate and buffer behavior.

HyperX Pulsefire Dart Reverse Engineering documents the mouse's USB control protocol from captured exchanges with NGenuity Beta and trial-and-error probing. It records 64-byte messages, settings commands, packet captures, a HIDAPI example and a work-in-progress Wireshark dissector.

Govee H6159 light-strip reverse engineer provides Linux shell scripts that send Bluetooth GATT commands directly to the H6159 light strip. The README documents device discovery, a characteristic write and basic commands for power and red, green or blue lighting.

Redragon RGB Controller sends recovered USB HID commands to set colors on Redragon Kala keyboards and Griffin mice. The author describes capturing the vendor software's USB exchanges with Wireshark and USBPcap, identifying command sequences, and implementing them in a Node.js CLI using node-hid.

Magenta Bridge implements direct HID communication with the Octavi IFR-1 flight-simulator panel in a Windows client for Microsoft Flight Simulator 2024. Its source handles panel input and SimConnect mappings for radios, autopilot and transponder controls; the author says the HID protocol was recovered through observation.

motospeedv40-re documents USB HID commands used by the Motospeed V40 mouse. The author captured Windows-driver traffic with Wireshark and records report sizes, initialization and settings commands, DPI byte values, and packet captures with diffs.

The Exway X1 Pro study investigates radio traffic between an electric skateboard and its remote. An Arduino sniffer using an nRF24L01+ transceiver listens to packets and exposes direction, gear and throttle readings; accompanying notes describe the remote hardware and radio investigation.

CoffeConnect investigates the DeLonghi ESAM 4000 control-panel circuit and its clock, serial-input and strobe signaling. A Raspberry Pi sampling script supports protocol inspection, while an ESP8266 prototype generates panel signals and exchanges MQTT messages with an Android app.

Vibease documents the BLE communication used by a Vibease vibrator. The author maps read and write characteristics, a device-supplied handshake key, XOR-based scrambling, Base64 encoding and fragmentation, and commands for fixed vibration and patterns; the repository also contains captures and Python utilities.

The Mieo HA102 study reconstructs the power meter's 433.9 MHz FSK packet format from recorded signals. It maps current, cumulative consumption and battery fields, describes CRC16/SPI-FUJITSU checking, and supplies a Python decoder for live rtl_433 output or saved captures.

esphome-midea-ir-tap reconstructs the demodulated infrared commands carried between a Midea-built heat pump's display and control boards. It documents six-byte frame timing and checksum behavior, provides ESP32 capture and decoding tools, and uses ESPHome to expose local controls and state in Home Assistant.

The Tesvor X500/X500 Pro project reconstructs the robot vacuum's local UART control and path-point messages for its ESP8266/ESP-12S module. ESPHome firmware exposes cleaning commands to Home Assistant and publishes path data over MQTT for a Python writer and map viewer.

The Bambu Lab P2S bridge reconstructs LAN control and monitoring for the printer from direct protocol probes. Its notes describe MQTT state deltas and commands, SSDP discovery, RTSPS H.264 video and FTPS session reuse; a TypeScript service and web client use those findings for local operation.

Beurer BM59 Unlocked documents the BLE exchange used by a BM59 blood pressure monitor to transfer measurements. From Android HCI captures, the author maps Nordic UART handles, the time write and measurement indications, and provides a Python client using Linux L2CAP/ATT sockets.

PiBuddyCam recreates the Prusa Buddy3D camera's cloud communication on a Raspberry Pi Zero 2 W using a protocol the author says was recovered from firmware. It registers with Prusa Connect, uploads snapshots, follows camera settings and answers WebRTC live-view requests; protocol documentation accompanies the implementation.

AirDrop for Windows investigates how an iPhone discovers receivers and sends files over AWDL. Its .NET receiver implements mDNS announcements, AirDrop endpoints and archive extraction; logs and research notes document the missing Windows radio path.

PSA VAN-CAN protocol bridge converts vehicle messages from AEE2001 to AEE2004 or AEE2010, and from AEE2004 to AEE2010, so newer PSA head units and displays can work in older cars. Its ESP32 firmware handles VAN and CAN traffic, including steering controls, dashboard data and display messages. The repository documents VAN frame encoding, fields, checks and reply timing.

aioharmony documents Logitech Harmony Hub authentication and control messages while providing an asyncio client for the device. Its protocol notes describe remote ID discovery, session-token exchange, and XMPP IQ stanzas. The client exposes activity, configuration, and device-command operations over WebSockets or XMPP.

MQB-sniffer documents CAN diagnostic traffic on a 2016 Volkswagen Golf MK7 by capturing exchanges between an OBDeleven adapter and the car. It identifies request and response IDs and records examples for engine RPM, ambient light, selected gear and gearbox mode.

ktm-can documents and parses CAN messages observed on a 2020 KTM 690 Enduro R motorcycle. Its Python decoder maps message IDs to fields including engine speed, throttle, gear, wheel speed and brake pressure; scripts inspect live and captured traffic. The author confirmed the documented data on that motorcycle.

Xbox-Smartglass-Core implements Xbox One SmartGlass communication in Python, including console discovery and control, media commands, Stump Live TV functions and title auxiliary streams. Its packet models, capture fixture and protocol documentation preserve details of the message exchanges.

Comet reimplements the game-facing GOG Galaxy Communication Service in Rust for use with alternative game launchers. It handles named SDK requests for library and authentication data, achievements, leaderboards, sessions, and overlay notifications. The project documents tracing Communication Service calls and identifies request types still pending.

PS3Sharp implements a cross-platform .NET client for PlayStation 3 memory access through TMAPI and other backends. The author reports reconstructing the SN Systems TMAPI debug protocol from Wireshark captures, enabling direct TCP access without Target Manager; the library also supports PS3MAPI, CCAPI and RPCS3.

PFire reconstructs an XFire server for client 1.127 using the service's messaging protocol. Its .NET implementation handles login, friends, status and chat, and the repository includes a specification of XFire message framing and attributes based on reverse-engineered protocol work.

poggadaj rebuilds Gadu-Gadu backend services in Go for historical messaging clients. A TCP service handles login, presence, contacts, and messages across several client versions, while an HTTP service supplies client endpoints and a web frontend provides account access.

volvo_vida_db reconstructs Volvo D2 ECU communication from VIDA 2014D database definitions and decompiled .NET services. Its scripts extract vehicle profiles and ECU parameters, form CAN request frames, reassemble multi-frame responses and decode parameter values for P1/P2-era vehicles.

UniSpy Server rebuilds GameSpy online services in Python using published GameSpy protocol research and an earlier server library as references. Its source organizes handlers for chat, game status, traffic relay, NAT negotiation, presence, query reporting, server browsing, and web services. The project documents Docker-based setup with PostgreSQL and Redis.

Reverse engineers the USB protocol of the Validity/Synaptics laptop fingerprint readers 138a:0090, 138a:0094, 138a:0097, 06cb:0081 and 06cb:009a, aiming at a written specification and a free libfprint driver. The repository holds a draft specification of the initialization sequence and of the modified TLS 1.2 handshake the readers use, a Wireshark Lua dissector that decrypts traffic after the key exchange, and a standalone C prototype that talks to a reader over libusb. The README calls the prototype extremely ugly code to be rewritten for the driver, and marks the integrated libfprint driver as not ready.

Documents the Bluetooth Low Energy GATT interface of Ember smart mugs, worked out from an Ember Mug 2 and a decompiled copy of the Android Ember app. Per-characteristic pages give UUIDs, read, write and notify methods and byte layouts for the mug name, LED colour, current and target temperature, temperature unit, battery and charging status, liquid level and state, date and time zone, firmware and hardware versions, and push events. A separate page lists the analytics fields that the decompiled app sends to Ember’s collection server.

Reimplements the Bluetooth Low Energy protocol of the BM2 (Battery Monitor 2) car battery monitor for independent voltage readings. A Python client built on Bleak decrypts the monitor's AES-encrypted notifications to read the current voltage and request the stored voltage history, an ESPHome template exposes the voltage from an ESP32, and example apps view and dump readings or forward them over MQTT. The author's write-up reports that the key and packet layout were recovered from the vendor app; results are author- and contributor-reported.

Documents the Oura Ring Bluetooth Low Energy request and response framing, request tags and payloads, and binary event stream. The BLE notes are confirmed on Oura Ring 4. Many packets remain unknown. The author says the event reference and Node.js parser were generated from the Oura app event-parser library and await manual verification.

An ISC-licensed rsync that copies a directory and checks the result. regress/functional/test00_simple.test builds dir1/one.txt, an expected tree under dir2, runs openrsync -a from dir1 to dir3, and compare_trees diffs the listings and file contents.

A browser viewer for the Thermal Master P3, which speaks a vendor USB protocol over vendor USB control transfers. tests/test_webusb.mjs compares built commands with captured 18-byte transfers, including read_name, and parses a captured status buffer.

SNX-VPN reconstructs the browser login stage of Check Point SSL VPN as a Python command-line client while using the vendor's snx binary to establish the tunnel. Its notes describe password encryption, cookies, the undocumented -Z option and the binary connection exchange on local TCP port 7776.

OpenDS reconstructs an FRC Driver Station client for Windows, Linux and macOS. Its Java code parses and builds year-specific robot-control packets and exposes enable, mode, joystick, status and NetworkTables functions for testing robots away from competition.

Recreates CO/Tech power-plug control with Arduino sketches that capture 24-bit commands from an original 433.92 MHz remote and transmit selected commands to paired plugs. The instructions describe the receiver connection, command capture and plug pairing.

ts3j implements the reverse-engineered TeamSpeak 3 full client protocol in Java, adapting an earlier C# client source. Its API connects to servers, tracks channels and clients, handles chat and sends or receives Opus audio packets.

The WCH BLE Analyzer Pro project reconstructs the USB capture protocol of a three-channel BLE sniffer and implements a Linux libusb driver. It sends monitor commands to the device's CH582F controllers, decodes returned frames and writes BLE link-layer packets to pcap for Wireshark. Research notes describe USB captures and analysis of bundled decoder scripts.

eoip implements MikroTik-compatible Ethernet-over-IP tunnelling in Linux kernel modules with a user-space management utility. The author says development used sniffed datagrams; the README documents the GRE-like packet format, tunnel configuration and keepalive behaviour for IPv4 and IPv6 variants.

PrimeComm implements file communication with the HP Prime calculator from the author's device reverse engineering. It provides a Windows GUI, PrimeCmd command-line access and PrimeLib for sending, receiving and converting calculator programs; the author says modern firmware changed the communication protocol.

MicronetToNMEA investigates Raymarine's Micronet wireless instrument protocol and implements a Teensy and CC1101 bridge to NMEA 0183. It receives Micronet traffic, converts wind, speed and other navigation data for a PC or tablet, and can send NMEA navigation data back to Micronet displays. The manual describes remaining uncertainties in the protocol.

openmili implements the Mi-Light 2.4 GHz LED control exchange with an nRF24 radio acting as a PL1167 backend. An Arduino sketch sends and receives framed packets over serial, while a Python daemon maps UDP commands to light-control messages with configurable sender IDs. The code specifies channels, sync words, CRC handling, and command mappings.

The AcuRite 00592TX investigation captures and decodes 433 MHz temperature-probe transmissions with Arduino. Its notes describe synchronization pulses, 56-bit frames, probe IDs, channel bits, temperature parity and the final running-sum byte.

DIY Saab 9-3 Tachometer investigates a 2007 Saab 9-3 CAN bus by logging traffic during controlled driving maneuvers and plotting bytes grouped by message ID. The author associates RPM with bytes 2–3 of 0x110 and vehicle speed with byte pairs in 0x280, then uses those signals for a Raspberry Pi display and gear estimate.

free-outernet reconstructs Outernet’s file and time broadcast services from reverse-engineered protocols. Its Python receiver accepts live UDP packets from gr-outernet or recorded KISS files, recovers transmitted files and prints time packets. The code also includes LDPC decoding to recover missing file blocks.

MikroTik WinBox Terminal Client implements RouterOS CLI access over the proprietary WinBox terminal protocol on TCP port 8291. Its Python code handles M2 TLV messages, EC-SRP5 or legacy MD5 authentication and AES-128-CBC terminal traffic. A companion specification records handshake fields, key derivation and message framing.

pippin implements a native Linux client for macOS high-performance Screen Sharing using documented protocol reverse-engineering work from iShareScreen. Its Rust code handles the connection, media transport and HEVC display, with clipboard support and byte-level tests against reference wire vectors.

OpenSpy Core reconstructs GameSpy online services as separate processes communicating through HTTP, AMQP, and Redis. Its QR service handles ASCII V1 and binary V2 formats, while server browsing supports legacy and enctypex variants. Other implemented services cover NAT negotiation, presence, account search, game statistics, chat, and selected EA FESL traffic.

OpenSnell reconstructs the Snell v4/v5 proxy protocol in a Go client and server. It handles TCP CONNECT, UDP over TCP, HTTP and TLS obfuscation, with v5 QUIC proxy mode on the server. The author reports interoperability against Surge snell-server v5.0.1.

starlink-rs reconstructs Protobuf definitions exposed through a Starlink user terminal's gRPC server reflection and implements a Rust client for the dish. Its examples exercise request and response handling and bidirectional streaming over the local HTTP/2 endpoint.

Acurite 00592TX Decoder implements a receiver for the 433.92 MHz messages sent by AcuRite 00592TX, 06002M and 06044 temperature sensors. The author documents pulse timing, sync structure and seven-byte fields for channel, sensor ID, status, humidity, temperature and checksum. ESP32 or ESP8266 code publishes readings through MQTT and can send alarms by email or SMS.

Mazda MX-5 CAN DBC records independently inferred HS-CAN and MS-CAN message definitions for 2015–2023 MX-5 vehicles. The author derives signal IDs, names, scales, offsets and behavior notes from vehicle observations, logs and known specifications. Some entries remain structural placeholders or under verification.

DavisRFM69 receives weather packets from the Davis Instruments Integrated Sensor Suite over its reverse-engineered radio link. The Arduino library adapts RFM69 hardware to the ISS transmissions and includes a Vantage Pro2 console emulation example for Cumulus weather software.