Case study
BTHackers: reconstructing the AIREC recorder’s BLE protocol
BTHackers documents the AIREC voice recorder’s BLE GATT service and command protocol from captured sessions. Its protocol reference maps characteristic handles and the 55 aa command and aa 55 response frames. The repository includes capture parsers, a Python client, and a Flutter app; the author lists connection fixes and the file-download command as open work.
- Targets
- Protocol
- Category
- Independent reconstruction cases
- Relationship
- Independent reconstruction project
- Sources reviewed
- Evidence class
- C2 code & docs, no demo or download
- Stars
- 1
- Last commit
- 2026-11-02
- Language
- Python
GitHub data as of 2026-11-10
Evidence
- Observed
- Code and documentation observed; no download method or demo found.
- Checked
- 2026-11-08
Requirements & limits
- Prerequisites: An AIREC voice recorder and BLE access are needed for live interaction.
- Limits: The Python client uses bleak and is documented as needing a connection fix.
- Limits: The file-download command has not yet been identified.
- License: No licence file in the repository.
Cite
BibTeX
@misc{bthackers-airec-case,
title = {{BTHackers: reconstructing the AIREC recorder’s BLE protocol}},
howpublished = {\url{https://github.com/RegeneratusLabs/BTHackers}},
url = {https://github.com/RegeneratusLabs/BTHackers},
urldate = {2026-11-06},
note = {Awesome REA entry: \url{https://awesomerea.org/resources/bthackers-airec-case/}}
}Plain text
BTHackers: reconstructing the AIREC recorder’s BLE protocol. https://github.com/RegeneratusLabs/BTHackers (accessed 2026-11-06). Awesome REA entry: https://awesomerea.org/resources/bthackers-airec-case/
Useful? Star Awesome REA on GitHub2.4k
About this entry
The description was reviewed against primary sources.
Primary sources
- docs/PROTOCOL.md GitHub · RegeneratusLabs/BTHackers · Revision 4b4a67e
- README.md GitHub · RegeneratusLabs/BTHackers · Revision 4b4a67e
More in Protocols
- MacBook ALS: mapping five HID color channels · Case study
- SteelSeries Apex 3: reconstructing RGB control over USB HID · Case study
- rfserver: reconstructing a 433 MHz light remote · Case study
- ro: a client for the LB-Link BL-WR2000 repeater · Case study
- dvf3060: reconstructing Kenwood DVF-3060 front-panel control · Case study
- galaxy-buds-plus: controlling Buds Plus through RFCOMM · Case study