AwesomeREA.org

Learning resource

Reverse-Engineering a Bluetooth-Enabled Radar Detector

Write-up of how the author decoded the Bluetooth RFCOMM protocol of a Cobra iRAD 900 radar detector so that a Raspberry Pi 3 could receive alerts without the iOS or Android app. Traffic was logged on a jailbroken iPhone with BTServer and filtered in Wireshark; the README then documents the detector's half-second status payload and the 9-byte reply whose ACK byte must echo the detector's sequence byte, and replays recorded responses to the initial settings sync instead of decoding it. A short beginner's case study on RFCOMM traffic analysis with a rough proof-of-concept script, not a maintained client.

Targets
Protocol
Category
Learning resources
Relationship
Learning resource
Sources reviewed

Requirements & limits

  • Written in 2017 and last expanded on 2017-07-06; the latest commit, from January 2025, only updates the contact email. It covers one detector model. The alert-type values are only partly identified because the author had no radar gun, the initial sync is replayed rather than decoded, and the README expects the replay data would need re-recording after app settings change.
  • Following the method needs a Cobra iRAD 900 used with its vendor app and a way to log the phone's Bluetooth traffic; the author used BTServer logging on a jailbroken iPhone 5 and Wireshark. The repository commits the author's three .pklg captures, the Wireshark XML export (data.xml) and the processed packetData.dat; no app or device firmware is included.
  • radar.py is a self-described extremely rough proof of concept that talks RFCOMM through PyBluez, with the author's detector address and service UUID hard-coded; its setup notes install the Python 2 python-bluez package. parseData.py converts data.xml into packetData.dat, which radar.py loads with pickle, so treat that file as executable input. Nothing was run for this review.
  • MIT License. Cobra's detector, app and trademarks keep their own rights. The reviewed sources establish no AI or REA use.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · brandonasuncion/Reverse-Engineering-Bluetooth-Protocols · Revision daf7c5c
  2. radar.py GitHub · brandonasuncion/Reverse-Engineering-Bluetooth-Protocols · Revision daf7c5c
  3. parseData.py GitHub · brandonasuncion/Reverse-Engineering-Bluetooth-Protocols · Revision daf7c5c
  4. BTServerCaptures GitHub · brandonasuncion/Reverse-Engineering-Bluetooth-Protocols · Revision daf7c5c
  5. LICENSE GitHub · brandonasuncion/Reverse-Engineering-Bluetooth-Protocols · Revision daf7c5c

More in References and learning

All 61 entries in References and learning