Case study
bluefluff: reverse engineering Furby Connect's Bluetooth LE protocol
Documents the Bluetooth Low Energy interface of Hasbro's Furby Connect toy, worked out, according to its notes, from the companion app's native library, sniffed BLE traffic and trial and error. It maps the GATT services and the command and response bytes of the toy's Nordic radio and GeneralPlus controller, covering action sequences, antenna colour, mood values, sensor reports and a hidden debug screen. fluffd, a Node.js daemon built on the noble BLE library, exposes these commands through an HTTP API and a browser control page.
Requirements & limits
- Most research commits date from 2017 and 2018, with a few later fixes and a Docker setup added in March 2026. The README reports that large parts of the BLE protocol are understood, while the action list is incomplete, the update (DLC) format is only partly explored, and code execution, custom LCD animations and the sleep-mask connector remain untried.
- Requires a Furby Connect and a host with Bluetooth LE, built in or through a USB Bluetooth 4.0+ adapter. The repository contains no Hasbro update files or app code, and this record covers neither obtaining nor modifying them. The README warns that interfacing in unwarranted ways can brick the toy and will almost certainly void its warranty.
- fluffd needs Node.js 7.0 or later according to the README and pins @abandonware/noble 1.9.2-23. The README covers Linux, which needs libudev development files and a running BlueZ, and macOS, which needs xpc-connection, and also names FreeBSD and Windows. The Docker image uses node:16-bullseye, needs host networking for raw HCI access and supports Linux hosts only.
- The findings are the author's documented observations, made without opening the toy. The repository has no tests or CI, and no commands were sent in this review.
- MIT (2017, Florian Euchner); the README's disclaimer says the information is for educational purposes only. Furby Connect, its companion app and Hasbro's content keep their own rights. The reviewed sources establish no REA or AI use.
About this entry
- Type
- Case study
- Category
- Independent reconstruction cases
- Relationship
- Independent reconstruction project
- Targets
- Protocol
Sources reviewed
The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.
Primary sources
- README.md GitHub · Jeija/bluefluff · Revision 9e865c4
- doc/bluetooth.md GitHub · Jeija/bluefluff · Revision 9e865c4
- doc/generalplus.md GitHub · Jeija/bluefluff · Revision 9e865c4
- doc/nordic.md GitHub · Jeija/bluefluff · Revision 9e865c4
- doc/actions.md GitHub · Jeija/bluefluff · Revision 9e865c4
- fluffd/fluffd.js GitHub · Jeija/bluefluff · Revision 9e865c4
- fluffd/package.json GitHub · Jeija/bluefluff · Revision 9e865c4
- Dockerfile GitHub · Jeija/bluefluff · Revision 9e865c4
- doc/docker.md GitHub · Jeija/bluefluff · Revision 9e865c4
- LICENSE.md GitHub · Jeija/bluefluff · Revision 9e865c4